wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/ssl
History
Matt Caswell 5e0a80c1c9 Fix ssl_get_prev_session overrun 
If OpenSSL is configured with no-tlsext then ssl_get_prev_session can read
past the end of the ClientHello message if the session_id length in the
ClientHello is invalid. This should not cause any security issues since the
underlying buffer is 16k in size. It should never be possible to overrun by
that many bytes.

This is probably made redundant by the previous commit - but you can never be
too careful.

With thanks to Qinghao Tang for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-14 14:58:49 +01:00
..
record Fix read_ahead issue 2015-04-10 16:21:20 +01:00
bio_ssl.c free NULL cleanup 10 2015-04-11 10:22:36 -04:00
d1_both.c Move last_write_sequence from s->d1 to s->rlayer.d. 2015-03-26 15:02:00 +00:00
d1_clnt.c Fix missing return value checks 2015-03-23 15:23:11 +00:00
d1_lib.c Move buffered_app_data from s->d1 to s->rlayer.d 2015-03-26 15:02:00 +00:00
d1_meth.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
d1_msg.c Split out non record layer functions out of s3_pkt.c and d1_pkt.c into 2015-03-26 15:01:59 +00:00
d1_srtp.c dead code cleanup: #if 0 in ssl 2015-02-06 10:52:12 -05:00
d1_srvr.c Remove last trace of non-record layer code reading and writing sequence 2015-03-26 15:02:01 +00:00
install-ssl.com Remove SSL_TASK, the DECnet Based SSL Engine - addendum 2015-03-31 22:19:22 +02:00
kssl.c dead code cleanup: #if 0 in ssl 2015-02-06 10:52:12 -05:00
kssl_lcl.h Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
Makefile make depend 2015-04-03 18:31:15 +01:00
s3_both.c Move read_sequence and write_sequence from s->s3 to s->rlayer 2015-03-26 15:02:00 +00:00
s3_cbc.c Move more SSL3_RECORD oriented functions into ssl3_record.c 2015-03-26 15:01:57 +00:00
s3_clnt.c free NULL cleanup 10 2015-04-11 10:22:36 -04:00
s3_enc.c Move ssl3_record_sequence_update into record layer 2015-03-26 15:02:00 +00:00
s3_lib.c Move s->packet and s->packet_length into s->rlayer 2015-03-26 15:02:00 +00:00
s3_meth.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
s3_msg.c Introduce the functions RECORD_LAYER_release, RECORD_LAYER_read_pending, and 2015-03-26 15:01:59 +00:00
s3_srvr.c Check for ClientHello message overruns 2015-04-14 14:58:25 +01:00
s23_clnt.c Move s->packet and s->packet_length into s->rlayer 2015-03-26 15:02:00 +00:00
s23_lib.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
s23_meth.c OPENSSL_NO_XXX cleanup: NO_TLS, NO_TLS1 2015-01-27 15:14:12 -05:00
s23_srvr.c Move s->packet and s->packet_length into s->rlayer 2015-03-26 15:02:00 +00:00
ssl-lib.com Remove SSL_TASK, the DECnet Based SSL Engine 2015-03-31 21:59:43 +02:00
ssl_algs.c Fix missing return value checks 2015-03-23 15:23:11 +00:00
ssl_asn1.c The wrong ifdef is used to guard usage of PSK code 2015-04-10 23:52:32 +01:00
ssl_cert.c free NULL cleanup 2015-03-28 10:54:15 -04:00
ssl_ciph.c Fix missing return value checks 2015-03-23 15:23:11 +00:00
ssl_conf.c free NULL cleanup 2015-03-25 11:31:18 -04:00
ssl_err.c return unexpected message when receiving kx with kDHr or kDHd 2015-03-23 21:08:20 +01:00
ssl_err2.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
ssl_lib.c free NULL cleanup 9 2015-04-11 16:32:54 -04:00
ssl_locl.h Renamed record layer header files 2015-03-26 15:02:01 +00:00
ssl_rsa.c free NULL cleanup 2015-03-25 11:31:18 -04:00
ssl_sess.c Fix ssl_get_prev_session overrun 2015-04-14 14:58:49 +01:00
ssl_stat.c Move s->rstate to s->rlayer.rstate 2015-03-26 15:02:00 +00:00
ssl_txt.c Fix missing return value checks 2015-03-23 15:23:11 +00:00
ssl_utst.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
t1_clnt.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
t1_enc.c Move read_sequence and write_sequence from s->s3 to s->rlayer 2015-03-26 15:02:00 +00:00
t1_ext.c Remove support for opaque-prf 2015-01-28 15:37:16 -05:00
t1_lib.c Removed dependency on rrec from heartbeat processing 2015-03-26 15:02:00 +00:00
t1_meth.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
t1_reneg.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
t1_srvr.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00
t1_trce.c dead code cleanup: #if 0 in ssl 2015-02-06 10:52:12 -05:00
tls_srp.c Run util/openssl-format-source -v -c . 2015-01-22 09:20:09 +00:00