Fix off-by-one errors in ssl_cipher_get_evp()

    In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

    Bug discovered and fixed by Miod Vallat from the OpenBSD team.

    PR#3375

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index a54c06ffb7d3e92e12c4382cbc3eb572e1da5155..c16ba1518894bfd000550dae8f729752eba09486 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -390,7 +390,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
                break;
                }
 
-       if ((i < 0) || (i > SSL_ENC_NUM_IDX))
+       if ((i < 0) || (i >= SSL_ENC_NUM_IDX))
                *enc=NULL;
        else
                {
@@ -412,7 +412,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
                i= -1;
                break;
                }
-       if ((i < 0) || (i > SSL_MD_NUM_IDX))
+       if ((i < 0) || (i >= SSL_MD_NUM_IDX))
                *md=NULL;
        else
                *md=ssl_digest_methods[i];