wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-07 01:20:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix ImportKeyState DTLS window OOB read

Browse Source
This commit is contained in:
Jeremiah Mackey
2026-03-26 15:58:07 +00:00
parent 7efc962d04
commit 7facd3e4f4
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/internal.c
+9
View File
@@ -1180,6 +1180,8 @@ static int ImportKeyState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver,
word16 i, wordCount, wordAdj = 0;
/* do window */
if (idx + OPAQUE16_LEN > len)
return BUFFER_E;
ato16(exp + idx, &wordCount);
idx += OPAQUE16_LEN;
@@ -1188,6 +1190,8 @@ static int ImportKeyState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver,
wordCount = WOLFSSL_DTLS_WINDOW_WORDS;
}
if (idx + (wordCount * OPAQUE32_LEN) + wordAdj > len)
return BUFFER_E;
XMEMSET(keys->peerSeq[0].window, 0xFF, DTLS_SEQ_SZ);
for (i = 0; i < wordCount; i++) {
ato32(exp + idx, &keys->peerSeq[0].window[i]);
@@ -1196,6 +1200,9 @@ static int ImportKeyState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver,
idx += wordAdj;
/* do prevWindow */
wordAdj = 0;
if (idx + OPAQUE16_LEN > len)
return BUFFER_E;
ato16(exp + idx, &wordCount);
idx += OPAQUE16_LEN;
@@ -1204,6 +1211,8 @@ static int ImportKeyState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver,
wordCount = WOLFSSL_DTLS_WINDOW_WORDS;
}
if (idx + (wordCount * OPAQUE32_LEN) + wordAdj > len)
return BUFFER_E;
XMEMSET(keys->peerSeq[0].prevWindow, 0xFF, DTLS_SEQ_SZ);
for (i = 0; i < wordCount; i++) {
ato32(exp + idx, &keys->peerSeq[0].prevWindow[i]);