tree 666a81e64fab46d18dfdea8b5f9e834295301f2a
parent 2a7030429b5669b28d772c5f62b137656c0534e9
author Gilles Peskine <Gilles.Peskine@arm.com> 1569585636 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1569585636 +0200

Parse HelloVerifyRequest: avoid buffer overread on the cookie

In ssl_parse_hello_verify_request, we print cookie_len bytes without
checking that there are that many bytes left in ssl->in_msg. This
could potentially log data outside the received message (not a big
deal) and could potentially read from memory outside of the receive
buffer (which would be a remotely exploitable crash).