commit d83584e9aa7bb7ebd955290a17eb1ca9bd9eab53
author Paul Bakker <p.j.bakker@polarssl.org> Tue Dec 31 11:35:16 2013 +0100
committer Paul Bakker <p.j.bakker@polarssl.org> Mon Jul 07 16:01:11 2014 +0200
tree 60e16813db994d11fdd1130edf17e95c7a0d31b9
parent 78e819698b80d0c5b0c8114c2521808f308a994d

Fixed potential overflow in certificate size in ssl_write_certificate()

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 3bc8e9b..aca990f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,8 @@
    * Fixed x509_crt_parse_path() bug on Windows platforms
    * Added missing MPI_CHK() around some statements in mpi_div_mpi() (found by
      TrustInSoft)
+   * Fixed potential overflow in certificate size verification in
+     ssl_write_certificate() (found by TrustInSoft)
 
 = Version 1.2.10 released 2013-10-07
 Changes

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index a8cc501..562f632 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2223,7 +2223,7 @@
     while( crt != NULL )
     {
         n = crt->raw.len;
-        if( i + 3 + n > SSL_MAX_CONTENT_LEN )
+        if( n > SSL_MAX_CONTENT_LEN - 3 - i )
         {
             SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
                            i + 3 + n, SSL_MAX_CONTENT_LEN ) );