Validate ClientHello extension field length

RT#4069

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 210a5e87430f266f76edb893f00be9656ae6d4d7..33af933ea934c2828527d7b9618bf199b4c96f26 100644 (file)
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2024,7 +2024,7 @@ static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
 
     n2s(data, len);
 
-    if (data > (d + n - len))
+    if (data + len != d + n)
         goto err;
 
     while (data <= (d + n - 4)) {