From e83aefb3a0c645c77849f889bc166935b2cc935c Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 22 Nov 2012 14:15:44 +0000 Subject: [PATCH 1/1] reject zero length point format list or supported curves extensions --- ssl/t1_lib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index c53eadfe30..fd13a317c1 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1853,7 +1853,8 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char unsigned char *sdata = data; int ecpointformatlist_length = *(sdata++); - if (ecpointformatlist_length != size - 1) + if (ecpointformatlist_length != size - 1 || + ecpointformatlist_length < 1) { *al = TLS1_AD_DECODE_ERROR; return 0; @@ -1889,7 +1890,8 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char int ellipticcurvelist_length = (*(sdata++) << 8); ellipticcurvelist_length += (*(sdata++)); - if (ellipticcurvelist_length != size - 2) + if (ellipticcurvelist_length != size - 2 || + ellipticcurvelist_length < 1) { *al = TLS1_AD_DECODE_ERROR; return 0; -- 2.34.1