Fix uninitialized read in sigalg parsing code
authorBenjamin Kaduk <bkaduk@akamai.com>
Fri, 26 Jan 2018 01:30:54 +0000 (19:30 -0600)
committerBenjamin Kaduk <bkaduk@akamai.com>
Fri, 26 Jan 2018 01:40:35 +0000 (19:40 -0600)
The check for a duplicate value was reading one entry past
where it was supposed to, getting an uninitialized value.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5172)

ssl/t1_lib.c

index d4c9086..7109741 100644 (file)
@@ -1781,7 +1781,7 @@ static int sig_cb(const char *elem, int len, void *arg)
 
     /* Reject duplicates */
     for (i = 0; i < sarg->sigalgcnt - 1; i++) {
-        if (sarg->sigalgs[i] == sarg->sigalgs[sarg->sigalgcnt]) {
+        if (sarg->sigalgs[i] == sarg->sigalgs[sarg->sigalgcnt - 1]) {
             sarg->sigalgcnt--;
             return 0;
         }