denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls: Check for minimal TLS record length before each record iteration

Browse Source 
Fixes fragment reassembling if a buffer contains more than one record, but
the last record contains a partial TLS record header. Thanks to Nick Saunders
and Jamil Nimeh for identifying this issue and providing a fix for it.
This commit is contained in:
Martin Willi
2014-03-31 15:56:12 +02:00
parent b886dad498
commit f93497507f
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls.c
+8 -8
View File
@@ -218,14 +218,7 @@ METHOD(tls_t, process, status_t,
{ {
if (this->input.len == 0) if (this->input.len == 0)
{ {
if (buflen < sizeof(tls_record_t)) while (buflen >= sizeof(tls_record_t))
{
DBG2(DBG_TLS, "received incomplete TLS record header");
memcpy(&this->head, buf, buflen);
this->headpos = buflen;
break;
}
while (TRUE)
{ {
/* try to process records inline */ /* try to process records inline */
record = buf; record = buf;
@@ -252,6 +245,13 @@ METHOD(tls_t, process, status_t,
return NEED_MORE; return NEED_MORE;
} }
} }
if (buflen < sizeof(tls_record_t))
{
DBG2(DBG_TLS, "received incomplete TLS record header");
memcpy(&this->head, buf, buflen);
this->headpos = buflen;
break;
}
} }
len = min(buflen, this->input.len - this->inpos); len = min(buflen, this->input.len - this->inpos);
memcpy(this->input.ptr + this->inpos, buf, len); memcpy(this->input.ptr + this->inpos, buf, len);