mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #4267 from elms/key_overflow

Browse Source 
tls13: avoid buffer overflow with size check
This commit is contained in:
David Garske 2021-08-09 09:19:46 -07:00 committed by GitHub
commit 0e4b200df1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/tls13.c
View File

@ -6073,6 +6073,10 @@ static int SendTls13CertificateVerify(WOLFSSL* ssl)
case TLS_ASYNC_BUILD: case TLS_ASYNC_BUILD:
{ {
int rem = ssl->buffers.outputBuffer.bufferSize
- ssl->buffers.outputBuffer.length
- RECORD_HEADER_SZ - HANDSHAKE_HEADER_SZ;
/* idx is used to track verify pointer offset to output */ /* idx is used to track verify pointer offset to output */
args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ; args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
args->verify = args->verify =
@ -6092,6 +6096,10 @@ static int SendTls13CertificateVerify(WOLFSSL* ssl)
goto exit_scv; goto exit_scv;
} }
if (rem < 0 || args->length > rem) {
ERROR_OUT(BUFFER_E, exit_scv);
}
if (args->length == 0) { if (args->length == 0) {
ERROR_OUT(NO_PRIVATE_KEY, exit_scv); ERROR_OUT(NO_PRIVATE_KEY, exit_scv);
} }