WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

fix item 5 from report by Ivan Fratric of the Google Security Team

pull/1/head
toddouska 2014-03-26 13:54:16 -07:00
parent 717f3adb47
commit 7e9be23628
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/internal.c
View File

@ -4739,7 +4739,8 @@ int DoApplicationData(CYASSL* ssl, byte* input, word32* inOutIdx)
/* process alert, return level */ /* process alert, return level */
static int DoAlert(CYASSL* ssl, byte* input, word32* inOutIdx, int* type) static int DoAlert(CYASSL* ssl, byte* input, word32* inOutIdx, int* type,
word32 totalSz)
{ {
byte level; byte level;
byte code; byte code;
@ -4752,6 +4753,11 @@ static int DoAlert(CYASSL* ssl, byte* input, word32* inOutIdx, int* type)
AddPacketInfo("Alert", &ssl->timeoutInfo, input + *inOutIdx - AddPacketInfo("Alert", &ssl->timeoutInfo, input + *inOutIdx -
RECORD_HEADER_SZ, 2 + RECORD_HEADER_SZ, ssl->heap); RECORD_HEADER_SZ, 2 + RECORD_HEADER_SZ, ssl->heap);
#endif #endif
/* make sure can read the message */
if (*inOutIdx + ALERT_SIZE > totalSz)
return BUFFER_E;
level = input[(*inOutIdx)++]; level = input[(*inOutIdx)++];
code = input[(*inOutIdx)++]; code = input[(*inOutIdx)++];
ssl->alert_history.last_rx.code = code; ssl->alert_history.last_rx.code = code;
@ -4769,6 +4775,8 @@ static int DoAlert(CYASSL* ssl, byte* input, word32* inOutIdx, int* type)
CYASSL_ERROR(*type); CYASSL_ERROR(*type);
if (ssl->keys.encryptionOn) { if (ssl->keys.encryptionOn) {
if (*inOutIdx + ssl->keys.padSz > totalSz)
return BUFFER_E;
*inOutIdx += ssl->keys.padSz; *inOutIdx += ssl->keys.padSz;
} }
@ -5213,7 +5221,8 @@ int ProcessReply(CYASSL* ssl)
case alert: case alert:
CYASSL_MSG("got ALERT!"); CYASSL_MSG("got ALERT!");
ret = DoAlert(ssl, ssl->buffers.inputBuffer.buffer, ret = DoAlert(ssl, ssl->buffers.inputBuffer.buffer,
&ssl->buffers.inputBuffer.idx, &type); &ssl->buffers.inputBuffer.idx, &type,
ssl->buffers.inputBuffer.length);
if (ret == alert_fatal) if (ret == alert_fatal)
return FATAL_ERROR; return FATAL_ERROR;
else if (ret < 0) else if (ret < 0)