tree fa356be10db328fcf1ef4194530e7ad67ba2d331
parent 99b6777b72fd982d5d617f21286df58d8980344e
author Gilles Peskine <Gilles.Peskine@arm.com> 1569585764 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1574342307 +0100

Parse HelloVerifyRequest: avoid buffer overread at the start

In ssl_parse_hello_verify_request, we read 3 bytes (version and cookie
length) without checking that there are that many bytes left in
ssl->in_msg. This could potentially read from memory outside of the
ssl->receive buffer (which would be a remotely exploitable
crash).