From: Matt Caswell <matt@openssl.org>
Date: Wed, 21 Oct 2015 09:00:24 +0000 (+0100)
Subject: Avoid undefined behaviour in PACKET_buf_init
X-Git-Tag: OpenSSL_1_1_0-pre1~404
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=3fde6c9276c9cd6e56e8e06e756350a4fbdd7031;p=oweals%2Fopenssl.git

Avoid undefined behaviour in PACKET_buf_init

Change the sanity check in PACKET_buf_init to check for excessive length
buffers, which should catch the interesting cases where len has been cast
from a negative value whilst avoiding any undefined behaviour.

RT#4094

Reviewed-by: Richard Levitte <levitte@openssl.org>
---

diff --git a/ssl/packet_locl.h b/ssl/packet_locl.h
index 507d64f8c4..cb61a93ad3 100644
--- a/ssl/packet_locl.h
+++ b/ssl/packet_locl.h
@@ -111,7 +111,7 @@ __owur static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf,
                                          size_t len)
 {
     /* Sanity check for negative values. */
-    if (buf + len < buf)
+    if (len > (size_t)(SIZE_MAX / 2))
         return 0;
 
     pkt->curr = buf;