Use TLSEXT_KEYNAME_LENGTH in tls_decrypt_ticket.
authorBernd Edlinger <bernd.edlinger@hotmail.de>
Mon, 13 Feb 2017 17:36:13 +0000 (18:36 +0100)
committerRich Salz <rsalz@openssl.org>
Tue, 14 Feb 2017 19:37:59 +0000 (14:37 -0500)
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2618)

ssl/t1_lib.c

index 7c8244d..eba3203 100644 (file)
@@ -1252,8 +1252,8 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick,
     }
     /* Attempt to decrypt session data */
     /* Move p after IV to start of encrypted ticket, update length */
-    p = etick + 16 + EVP_CIPHER_CTX_iv_length(ctx);
-    eticklen -= 16 + EVP_CIPHER_CTX_iv_length(ctx);
+    p = etick + TLSEXT_KEYNAME_LENGTH + EVP_CIPHER_CTX_iv_length(ctx);
+    eticklen -= TLSEXT_KEYNAME_LENGTH + EVP_CIPHER_CTX_iv_length(ctx);
     sdec = OPENSSL_malloc(eticklen);
     if (sdec == NULL || EVP_DecryptUpdate(ctx, sdec, &slen, p,
                                           (int)eticklen) <= 0) {