denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-server: Prevent infinite loop if supported versions are too short

Browse Source 
If the extension doesn't contain a multiple of two bytes, the previous
code would get stuck in an infinite loop as `remaining()` continued to
return TRUE while `read_uint16()` failed to parse a value. Initiating
several connections with such an extension allows a DoS attack as no
threads would eventually be available to handle packets/events.

Fixes: 7fbe2e27ec ("tls-server: TLS 1.3 support for TLS server implementation")
Fixes: CVE-2026-35328
This commit is contained in:
Tobias Brunner
2026-04-21 16:48:56 +02:00
parent 64130ede5c
commit 56c7f0d13d
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_server.c
+4 -7
View File
@@ -470,15 +470,12 @@ static status_t process_client_hello(private_tls_server_t *this,
bio_reader_t *client_versions; bio_reader_t *client_versions;
client_versions = bio_reader_create(versions); client_versions = bio_reader_create(versions);
while (client_versions->remaining(client_versions)) while (client_versions->read_uint16(client_versions, &version))
{ {
if (client_versions->read_uint16(client_versions, &version)) if (this->tls->set_version(this->tls, version, version))
{ {
if (this->tls->set_version(this->tls, version, version)) this->client_version = version;
{ break;
this->client_version = version;
break;
}
} }
} }
client_versions->destroy(client_versions); client_versions->destroy(client_versions);