From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Fri, 20 Jan 2017 20:23:10 +0000 (+0100)
Subject: tls: check size on "MAC-only, no crypt" code path too
X-Git-Tag: 1_27_0~191
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=0af5265180877f4e8fbf8f1d9f2999b3fd2205d3;p=oweals%2Fbusybox.git

tls: check size on "MAC-only, no crypt" code path too

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---

diff --git a/networking/tls.c b/networking/tls.c
index fb49b1523..80e3bc662 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -810,14 +810,15 @@ static int tls_xread_record(tls_state_t *tls)
 		dbg("encrypted size:%u type:0x%02x padding_length:0x%02x\n", sz, p[0], padding_len);
 		padding_len++;
 		sz -= SHA256_OUTSIZE + padding_len; /* drop MAC and padding */
-		if (sz < 0) {
-			bb_error_msg_and_die("bad padding size:%u", padding_len);
-		}
+		//if (sz < 0)
+		//	bb_error_msg_and_die("bad padding size:%u", padding_len);
 	} else {
 		/* if nonzero, then it's TLS_RSA_WITH_NULL_SHA256: drop MAC */
 		/* else: no encryption yet on input, subtract zero = NOP */
 		sz -= tls->min_encrypted_len_on_read;
 	}
+	if (sz < 0)
+		bb_error_msg_and_die("encrypted data too short");
 
 	//dump_hex("<< %s\n", tls->inbuf, RECHDR_LEN + sz);