wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Validate ClientHello session_id field length and send alert on failure

Browse source 
RT#4080

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
This commit is contained in:
Alessandro Ghedini 2016-01-13 12:49:24 +00:00 committed by Matt Caswell
parent 0555901cb4
commit 607e77300e
3 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ssl/s2_srvr.c
View file

@ -598,6 +598,11 @@ static int get_client_hello(SSL *s)
s->s2->tmp.cipher_spec_length = i;
n2s(p, i);
s->s2->tmp.session_id_length = i;
if ((i < 0) || (i > SSL_MAX_SSL_SESSION_ID_LENGTH)) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
return -1;
}
n2s(p, i);
s->s2->challenge_length = i;
if ((i < SSL2_MIN_CHALLENGE_LENGTH) ||

6
ssl/s3_srvr.c
View file

@ -1004,6 +1004,12 @@ int ssl3_get_client_hello(SSL *s)
goto f_err;
}
if ((j < 0) || (j > SSL_MAX_SSL_SESSION_ID_LENGTH)) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
goto f_err;
}
s->hit = 0;
/*
* Versions before 0.9.7 always allow clients to resume sessions in

3
ssl/ssl_sess.c
View file

@ -573,9 +573,6 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
int r;
#endif
if (len < 0 || len > SSL_MAX_SSL_SESSION_ID_LENGTH)
goto err;
if (session_id + len > limit) {
fatal = 1;
goto err;