From 3dce109905deb869ec395eeaafdcfae08292a04c Mon Sep 17 00:00:00 2001 From: Rich Salz Date: Thu, 8 Jun 2017 09:26:20 -0400 Subject: [PATCH] Fix possible memory over-read in apps/s_client.c a buffer returned from BIO_gets is not checked for it's length before reading its contents. Reviewed-by: Ben Kaduk Reviewed-by: Andy Polyakov Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3630) --- apps/s_client.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/apps/s_client.c b/apps/s_client.c index 9ec7217376..84dad97a04 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -2172,6 +2172,15 @@ int s_client_main(int argc, char **argv) * HTTP/d.d ddd Reason text\r\n */ mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); + if (mbuf_len < (int)strlen("HTTP/1.0 200")) { + BIO_printf(bio_err, + "%s: HTTP CONNECT failed, insufficient response " + "from proxy (got %d octets)\n", prog, mbuf_len); + (void)BIO_flush(fbio); + BIO_pop(fbio); + BIO_free(fbio); + goto shut; + } if (mbuf[8] != ' ') { BIO_printf(bio_err, "%s: HTTP CONNECT failed, incorrect response " -- 2.25.1