From 236ef93c50fac9498b77c690611ae61f1f65142a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 20 Mar 2026 16:05:27 +0100 Subject: [PATCH] tls-peer: Ensure TLS 1.3 CertificateRequest structure is valid If nothing was read from the message, the previous code could result in a crash depending on where `ext.ptr` pointed to, as determined by the current stack contents. Since TLS 1.3 is still disabled by default and this is usually used for TLS-based EAP methods after validating the IKEv2 server's certificate, the real world impact seems relatively low. Fixes: 9ef46cfaf917 ("tls-peer: Mutual authentication support for TLS 1.3") --- src/libtls/tls_peer.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c index 78652c064..bfdba3eab 100644 --- a/src/libtls/tls_peer.c +++ b/src/libtls/tls_peer.c @@ -936,9 +936,14 @@ static status_t process_certreq(private_tls_peer_t *this, bio_reader_t *reader) } else { - /* certificate request context as described in RFC 8446, section 4.3.2 */ - reader->read_data8(reader, &context); - reader->read_data16(reader, &ext); + /* certificate request as described in RFC 8446, section 4.3.2 */ + if (!reader->read_data8(reader, &context) || + !reader->read_data16(reader, &ext)) + { + DBG1(DBG_TLS, "received invalid CertificateRequest"); + this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR); + return NEED_MORE; + } extensions = bio_reader_create(ext); while (extensions->remaining(extensions)) { @@ -984,7 +989,7 @@ static status_t process_certreq(private_tls_peer_t *this, bio_reader_t *reader) } extension->destroy(extension); } - extensions->destroy(extensions); + extensions->destroy(extensions); } this->certreq_received = TRUE; this->state = STATE_CERTREQ_RECEIVED;