commit de9c8a573499746d838cece37e6f72702145a129
author Manuel Pégourié-Gonnard <mpg2@elzevir.fr> Fri Oct 02 11:16:47 2015 +0200
committer Manuel Pégourié-Gonnard <mpg2@elzevir.fr> Fri Oct 02 12:04:20 2015 +0200
tree 63fbb58262df3193a5d208cff57a9c9301952d86
parent c7e61a2e3fd58cb8d3eda9ce4fd422a0bb3a6843

Fix potential overflow in CertificateRequest

library/ssl_srv.c

diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 379a3ab..82fa2d4 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -2300,6 +2300,7 @@
     size_t ct_len, sa_len; /* including length bytes */
     unsigned char *buf, *p;
     const x509_crt *crt;
+    const unsigned char * const end = ssl->out_msg + SSL_MAX_CONTENT_LEN;
 
     SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
 
@@ -2406,10 +2407,14 @@
     total_dn_size = 0;
     while( crt != NULL && crt->version != 0 )
     {
-        if( p - buf > 4096 )
-            break;
-
         dn_size = crt->subject_raw.len;
+
+        if( end < p || (size_t)( end - p ) < 2 + dn_size )
+        {
+            SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
+            break;
+        }
+
         *p++ = (unsigned char)( dn_size >> 8 );
         *p++ = (unsigned char)( dn_size      );
         memcpy( p, crt->subject_raw.p, dn_size );