Validate ClientHello extension field length
authorAlessandro Ghedini <alessandro@ghedini.me>
Fri, 2 Oct 2015 11:43:29 +0000 (13:43 +0200)
committerMatt Caswell <matt@openssl.org>
Mon, 5 Oct 2015 18:43:00 +0000 (19:43 +0100)
RT#4069

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
ssl/t1_lib.c

index aeae5b0..4975c10 100644 (file)
@@ -1927,6 +1927,9 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al)
     if (!PACKET_get_net_2(pkt, &len))
         goto err;
 
+    if (PACKET_remaining(pkt) != len)
+        goto err;
+
     while (PACKET_get_net_2(pkt, &type) && PACKET_get_net_2(pkt, &size)) {
         PACKET subpkt;