wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-07 17:40:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

additional sanity check on number of groups passed to set groups function

Browse Source
This commit is contained in:
JacobBarthelmeh
2026-03-04 10:15:27 -07:00
parent 350706d2c8
commit 6b3dec4898
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ssl.c
+8
View File
@@ -3041,6 +3041,10 @@ int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
WOLFSSL_MSG("Group count is zero");
return WOLFSSL_FAILURE;
}
if (count > WOLFSSL_MAX_GROUP_COUNT) {
WOLFSSL_MSG("Group count exceeds maximum");
return WOLFSSL_FAILURE;
}
for (i = 0; i < count; i++) {
if (isValidCurveGroup((word16)groups[i])) {
_groups[i] = groups[i];
@@ -3076,6 +3080,10 @@ int wolfSSL_set1_groups(WOLFSSL* ssl, int* groups, int count)
WOLFSSL_MSG("Group count is zero");
return WOLFSSL_FAILURE;
}
if (count > WOLFSSL_MAX_GROUP_COUNT) {
WOLFSSL_MSG("Group count exceeds maximum");
return WOLFSSL_FAILURE;
}
for (i = 0; i < count; i++) {
if (isValidCurveGroup((word16)groups[i])) {
_groups[i] = groups[i];
tests/api/test_tls13.c
+14
View File
@@ -119,6 +119,9 @@ int test_tls13_apis(void)
int bad_groups[2] = { 0xDEAD, 0xBEEF };
#endif /* !NO_WOLFSSL_SERVER || !NO_WOLFSSL_CLIENT */
int numGroups = 2;
#if defined(OPENSSL_EXTRA) && !defined(NO_WOLFSSL_CLIENT)
int too_many_groups[WOLFSSL_MAX_GROUP_COUNT + 1];
#endif
#endif
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC)
char groupList[] =
@@ -605,6 +608,17 @@ int test_tls13_apis(void)
#endif
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(NULL, groupList),
WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
#ifndef NO_WOLFSSL_CLIENT
{
int idx;
for (idx = 0; idx < WOLFSSL_MAX_GROUP_COUNT + 1; idx++)
too_many_groups[idx] = WOLFSSL_ECC_SECP256R1;
}
ExpectIntEQ(wolfSSL_CTX_set1_groups(clientCtx, too_many_groups,
WOLFSSL_MAX_GROUP_COUNT + 1), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
ExpectIntEQ(wolfSSL_set1_groups(clientSsl, too_many_groups,
WOLFSSL_MAX_GROUP_COUNT + 1), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
#endif
#ifndef NO_WOLFSSL_CLIENT
#ifndef WOLFSSL_NO_TLS12
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(clientTls12Ctx, groupList),