feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Use record size instead of buffer size to validate alert length (#4425)

Browse Source
This commit is contained in:
Juliusz Sosinowicz
2021-09-27 00:05:13 +02:00
committed by GitHub
parent 7319627533
commit 32e4d5ad70
1 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/internal.c
View File

@@ -15912,12 +15912,12 @@ static void LogAlert(int type)
} }
/* process alert, return level */ /* process alert, return level */
static int DoAlert(WOLFSSL* ssl, byte* input, word32* inOutIdx, int* type, static int DoAlert(WOLFSSL* ssl, byte* input, word32* inOutIdx, int* type)
word32 totalSz)
{ {
byte level; byte level;
byte code; byte code;
word32 dataSz = totalSz - *inOutIdx; word32 dataSz = (word32)ssl->curSize;
int ivExtra = 0;
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA) #if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
if (ssl->hsInfoOn) if (ssl->hsInfoOn)
@@ -15929,6 +15929,19 @@ static int DoAlert(WOLFSSL* ssl, byte* input, word32* inOutIdx, int* type,
READ_PROTO, ssl->heap); READ_PROTO, ssl->heap);
#endif #endif
#ifndef WOLFSSL_AEAD_ONLY
if (ssl->specs.cipher_type == block) {
if (ssl->options.tls1_1)
ivExtra = ssl->specs.block_size;
}
else
#endif
if (ssl->specs.cipher_type == aead) {
if (CipherHasExpIV(ssl))
ivExtra = AESGCM_EXP_IV_SZ;
}
dataSz -= ivExtra;
if (IsEncryptionOn(ssl, 0)) { if (IsEncryptionOn(ssl, 0)) {
dataSz -= ssl->keys.padSz; dataSz -= ssl->keys.padSz;
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY) #if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
@@ -16984,8 +16997,7 @@ int ProcessReplyEx(WOLFSSL* ssl, int allowSocketErr)
case alert: case alert:
WOLFSSL_MSG("got ALERT!"); WOLFSSL_MSG("got ALERT!");
ret = DoAlert(ssl, ssl->buffers.inputBuffer.buffer, ret = DoAlert(ssl, ssl->buffers.inputBuffer.buffer,
&ssl->buffers.inputBuffer.idx, &type, &ssl->buffers.inputBuffer.idx, &type);
ssl->buffers.inputBuffer.length);
if (ret == alert_fatal) if (ret == alert_fatal)
return FATAL_ERROR; return FATAL_ERROR;
else if (ret < 0) else if (ret < 0)