Fix heap-buffer overread in ALPN ext parsing
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 90995c0..2cdf227 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -791,25 +791,33 @@
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
/*
- * Use our order of preference
+ * Validate peer's list (lengths)
*/
start = buf + 2;
end = buf + len;
+ for( theirs = start; theirs != end; theirs += cur_len )
+ {
+ cur_len = *theirs++;
+
+ /* Current identifier must fit in list */
+ if( cur_len > (size_t)( end - theirs ) )
+ return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+
+ /* Empty strings MUST NOT be included */
+ if( cur_len == 0 )
+ return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+ }
+
+ /*
+ * Use our order of preference
+ */
for( ours = ssl->alpn_list; *ours != NULL; ours++ )
{
ours_len = strlen( *ours );
for( theirs = start; theirs != end; theirs += cur_len )
{
- /* If the list is well formed, we should get equality first */
- if( theirs > end )
- return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-
cur_len = *theirs++;
- /* Empty strings MUST NOT be included */
- if( cur_len == 0 )
- return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-
if( cur_len == ours_len &&
memcmp( theirs, *ours, cur_len ) == 0 )
{