sanity check on hashing size

2018-06-18 15:50:44 -06:00
parent c78a552eb3
commit 38f916a798
1 changed files with 5 additions and 0 deletions
--- a/src/internal.c
+++ b/src/internal.c
@ -12242,6 +12242,11 @@ static INLINE int VerifyMac(WOLFSSL* ssl, const byte* input, word32 msgSz,
        padByte = 1;

        if (ssl->options.tls) {
+            /* Sanity check for underflow, TimingPadVerify performs hash on size
+             * (msgSz - ivExtra) - digestSz - pad - 1 */
+            if (digestSz + pad + 1 > (msgSz - ivExtra)) {
+                return BUFFER_E;
+            }
            ret = TimingPadVerify(ssl, input, pad, digestSz, msgSz - ivExtra,
                                  content);
            if (ret != 0)