mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dtls-srtp: check that length of strings matched before memcomparing

Browse Source 
otherwise if profile_str_len is > strlen(gSrtpProfiles[i].name) we end up
comparing memory past gSrtpProfiles[i].name. -fsanitize=address catches this:

```
==100159==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f40d8d533b2 at pc 0x7f40d8eb014f bp 0x7f40d50fe240 sp 0x7f40d50fd9e8
READ of size 21 at 0x7f40d8d533b2 thread T107
    #0 0x7f40d8eb014e in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:860
    #1 0x7f40d8eb06e6 in __interceptor_memcmp /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:892
    #2 0x7f40d8eb06e6 in __interceptor_memcmp /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:887
    #3 0x7f40d8c2e830 in DtlsSrtpFindProfile src/ssl.c:1310
    #4 0x7f40d8c2e9ed in DtlsSrtpSelProfiles src/ssl.c:1347
    #5 0x7f40d8c2eada in wolfSSL_CTX_set_tlsext_use_srtp src/ssl.c:1359
    #6 0x563bf381b4c5 in server_test examples/server/server.c:2278
    #7 0x7f40d88f0258 in start_thread (/usr/lib/libpthread.so.0+0x9258)
    #8 0x7f40d88195e2 in __GI___clone (/usr/lib/libc.so.6+0xfe5e2)
```
This commit is contained in:
Marco Oliverio 2022-01-19 12:25:25 +01:00
parent ba589955f7
commit 9b69f693e4
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/ssl.c
View File

@ -1301,13 +1301,18 @@ static const WOLFSSL_SRTP_PROTECTION_PROFILE gSrtpProfiles[] = {
static const WOLFSSL_SRTP_PROTECTION_PROFILE* DtlsSrtpFindProfile(
const char* profile_str, word32 profile_str_len, unsigned long id)
{
size_t srtp_profile_len;
int i;
const WOLFSSL_SRTP_PROTECTION_PROFILE* profile = NULL;
for (i=0;
i<(int)(sizeof(gSrtpProfiles)/sizeof(WOLFSSL_SRTP_PROTECTION_PROFILE));
i++) {
if (profile_str != NULL) {
if (XMEMCMP(gSrtpProfiles[i].name, profile_str, profile_str_len)
srtp_profile_len = strlen(gSrtpProfiles[i].name);
if (srtp_profile_len != profile_str_len)
continue;
if (XMEMCMP(gSrtpProfiles[i].name, profile_str, profile_str_len)
== 0) {
profile = &gSrtpProfiles[i];
break;