From 8c9365a690e2d5f0c49f3d9a3d41973ed9dcedcc Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 14 Oct 2016 11:49:06 +0100 Subject: [PATCH] Fix length check writing status request extension The status request extension did not correctly check its length, meaning that writing the extension could go 2 bytes beyond the buffer size. In practice this makes little difference because, due to logic in buffer.c the buffer is actually over allocated by approximately 5k! Issue reported by Guido Vranken. Reviewed-by: Rich Salz --- ssl/t1_lib.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index a3fb28e9cb..094a8a861a 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1261,7 +1261,14 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, } else extlen = 0; - if ((long)(limit - ret - 7 - extlen - idlen) < 0) + /* + * 2 bytes for status request type + * 2 bytes for status request len + * 1 byte for OCSP request type + * 2 bytes for length of ids + * 2 bytes for length of extensions + */ + if ((long)(limit - ret - 9 - extlen - idlen) < 0) return NULL; s2n(TLSEXT_TYPE_status_request, ret); if (extlen + idlen > 0xFFF0) -- 2.25.1