wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

TLSv1.3 alert and handshake messages can never be 0 length

Browse source 
We abort if we read a message like this.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)
This commit is contained in:
Matt Caswell 2017-05-11 10:34:25 +01:00
parent 0b367d7955
commit fc4c15faa4
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
ssl/record/ssl3_record.c
View file

@ -644,6 +644,15 @@ int ssl3_get_record(SSL *s)
&thisrr->data[end], 1, s, s->msg_callback_arg);
}
if (SSL_IS_TLS13(s)
&& (thisrr->type == SSL3_RT_HANDSHAKE
|| thisrr->type == SSL3_RT_ALERT)
&& thisrr->length == 0) {
al = SSL_AD_UNEXPECTED_MESSAGE;
SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_LENGTH);
goto f_err;
}
if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
al = SSL_AD_RECORD_OVERFLOW;
SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);