From: Dr. Stephen Henson <steve@openssl.org>
Date: Thu, 22 Nov 2012 14:15:00 +0000 (+0000)
Subject: reject zero length point format list or supported curves extensions
X-Git-Tag: OpenSSL_1_0_0k~33
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=8124ebcd788fc7dc33e3f6eff58a87836d3aaeee;p=oweals%2Fopenssl.git

reject zero length point format list or supported curves extensions
---

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index eb5c0c5f53..ffd5bf294e 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -806,7 +806,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 			int ellipticcurvelist_length = (*(sdata++) << 8);
 			ellipticcurvelist_length += (*(sdata++));
 
-			if (ellipticcurvelist_length != size - 2)
+			if (ellipticcurvelist_length != size - 2 ||
+				ellipticcurvelist_length < 1)
 				{
 				*al = TLS1_AD_DECODE_ERROR;
 				return 0;
@@ -1065,7 +1066,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 			unsigned char *sdata = data;
 			int ecpointformatlist_length = *(sdata++);
 
-			if (ecpointformatlist_length != size - 1)
+			if (ecpointformatlist_length != size - 1 || 
+				ecpointformatlist_length < 1)
 				{
 				*al = TLS1_AD_DECODE_ERROR;
 				return 0;