commit ad17fe9c377def269b4d96537f21427e4fddcdd2
author Hanno Becker <hanno.becker@arm.com> Thu Aug 16 15:51:34 2018 +0100
committer Hanno Becker <hanno.becker@arm.com> Thu Aug 16 15:51:34 2018 +0100
tree 7e496901bddece2965bc0a185d5b99f27b240320
parent d8f41698d298cb375722629675ec6c6ef5b5ebfd

Fix overly strict bounds check in ssl_parse_certificate_request()

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 321d636..4666083 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -2721,7 +2721,7 @@
      * therefore the buffer length at this point must be greater than that
      * regardless of the actual code path.
      */
-    if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
+    if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,