wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

CID 337219 allocation using untrusted size

Browse Source
This commit is contained in:
JacobBarthelmeh
2024-03-18 16:04:37 +07:00
parent 635d326812
commit 44f3e4a3b7
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/quic.c
View File

@ -83,6 +83,11 @@ static QuicRecord *quic_record_make(WOLFSSL *ssl,
} }
else { else {
qr->capacity = qr->len = qr_length(data, len); qr->capacity = qr->len = qr_length(data, len);
if (qr->capacity > WOLFSSL_QUIC_MAX_RECORD_CAPACITY) {
WOLFSSL_MSG("QUIC length read larger than expected");
quic_record_free(ssl, qr);
return NULL;
}
} }
if (qr->capacity == 0) { if (qr->capacity == 0) {
qr->capacity = 2*1024; qr->capacity = 2*1024;
@ -131,7 +136,8 @@ static int quic_record_append(WOLFSSL *ssl, QuicRecord *qr, const uint8_t *data,
qr->len = qr_length(qr->data, qr->end); qr->len = qr_length(qr->data, qr->end);
/* sanity check on length read from wire before use */ /* sanity check on length read from wire before use */
if (qr->len > (len + qr->capacity)) { if (qr->len > WOLFSSL_QUIC_MAX_RECORD_CAPACITY) {
WOLFSSL_MSG("Length read for quic is larger than expected");
ret = BUFFER_E; ret = BUFFER_E;
goto cleanup; goto cleanup;
} }

9
wolfssl/quic.h
View File

@ -290,6 +290,15 @@ int wolfSSL_quic_hkdf(uint8_t* dest, size_t destlen,
const uint8_t* salt, size_t saltlen, const uint8_t* salt, size_t saltlen,
const uint8_t* info, size_t infolen); const uint8_t* info, size_t infolen);
/* most common QUIC packet size as of 2022 was 1,200 bytes
* largest packet size listed in the RFC is 1,392 bytes
* this gives plenty of breathing room for capacity of records but keeps sizes
* read from the wire sane */
#ifndef WOLFSSL_QUIC_MAX_RECORD_CAPACITY
/* 1024*1024 -- 1 MB */
#define WOLFSSL_QUIC_MAX_RECORD_CAPACITY 1048576
#endif
#endif /* WOLFSSL_QUIC */ #endif /* WOLFSSL_QUIC */
#ifdef __cplusplus #ifdef __cplusplus