WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #3179 from ejohnstown/suitesz 

Suite Size Check
pull/3203/head
toddouska 2020-08-06 11:05:10 -07:00 committed by GitHub
parent 15be5476e9 fd4f8fe7a0
commit e121139178
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/internal.c
View File

@ -26758,6 +26758,9 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
if (clSuites.suiteSz > WOLFSSL_MAX_SUITE_SZ)
return BUFFER_ERROR;
/* Make sure the suiteSz is a multiple of 3. (Old Client Hello) */
if (clSuites.suiteSz % 3 != 0)
return BUFFER_ERROR;
clSuites.hashSigAlgoSz = 0;
/* session size */
@ -27221,6 +27224,10 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
ato16(&input[i], &clSuites.suiteSz);
i += OPAQUE16_LEN;
/* Cipher suite lists are always multiples of two in length. */
if (clSuites.suiteSz % 2 != 0)
return BUFFER_ERROR;
/* suites and compression length check */
if ((i - begin) + clSuites.suiteSz + OPAQUE8_LEN > helloSz)
return BUFFER_ERROR;
@ -27432,6 +27439,9 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
if (OPAQUE16_LEN + hashSigAlgoSz > extSz)
return BUFFER_ERROR;
if (hashSigAlgoSz % 2 != 0)
return BUFFER_ERROR;
clSuites.hashSigAlgoSz = hashSigAlgoSz;
if (clSuites.hashSigAlgoSz > WOLFSSL_MAX_SIGALGO) {
WOLFSSL_MSG("ClientHello SigAlgo list exceeds max, "

4
src/tls.c
View File

@ -6423,6 +6423,10 @@ static int TLSX_SignatureAlgorithms_Parse(WOLFSSL *ssl, byte* input,
if (length != OPAQUE16_LEN + len)
return BUFFER_ERROR;
/* Sig Algo list size must be even. */
if (suites->hashSigAlgoSz % 2 != 0)
return BUFFER_ERROR;
/* truncate hashSigAlgo list if too long */
suites->hashSigAlgoSz = len;
if (suites->hashSigAlgoSz > WOLFSSL_MAX_SIGALGO) {