From: David Benjamin <davidben@google.com>
Date: Mon, 2 Jun 2014 17:55:20 +0000 (+0100)
Subject: Check there is enough room for extension.
X-Git-Tag: OpenSSL_1_0_1h~9
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=ebda73f867160adc26b16a579e7901a119b5eb82;p=oweals%2Fopenssl.git

Check there is enough room for extension.
(cherry picked from commit 7d89b3bf42e4b4067371ab33ef7631434e41d1e4)
---

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 4710a885a7..3b8d5153eb 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -617,6 +617,8 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
 
 #ifndef OPENSSL_NO_HEARTBEATS
 	/* Add Heartbeat extension */
+	if ((limit - ret - 4 - 1) < 0)
+		return NULL;
 	s2n(TLSEXT_TYPE_heartbeat,ret);
 	s2n(1,ret);
 	/* Set mode:
@@ -844,6 +846,8 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
 	/* Add Heartbeat extension if we've received one */
 	if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
 		{
+		if ((limit - ret - 4 - 1) < 0)
+			return NULL;
 		s2n(TLSEXT_TYPE_heartbeat,ret);
 		s2n(1,ret);
 		/* Set mode: