From 5101c35c9173e40051acb23e45aae128fb84806e Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 10 Apr 2015 16:49:33 +0100 Subject: [PATCH] Fix ssl_get_prev_session overrun If OpenSSL is configured with no-tlsext then ssl_get_prev_session can read past the end of the ClientHello message if the session_id length in the ClientHello is invalid. This should not cause any security issues since the underlying buffer is 16k in size. It should never be possible to overrun by that many bytes. This is probably made redundant by the previous commit - but you can never be too careful. With thanks to Qinghao Tang for reporting this issue. Reviewed-by: Rich Salz (cherry picked from commit 5e0a80c1c9b2b06c2d203ad89778ce1b98e0b5ad) --- ssl/ssl_sess.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index 1e1002fc85..dce90887bb 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -452,6 +452,11 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len, if (len > SSL_MAX_SSL_SESSION_ID_LENGTH) goto err; + if (session_id + len > limit) { + fatal = 1; + goto err; + } + if (len == 0) try_session_cache = 0; -- 2.34.1