From ebda73f867160adc26b16a579e7901a119b5eb82 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Mon, 2 Jun 2014 18:55:20 +0100 Subject: [PATCH] Check there is enough room for extension. (cherry picked from commit 7d89b3bf42e4b4067371ab33ef7631434e41d1e4) --- ssl/t1_lib.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 4710a885a7..3b8d5153eb 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -617,6 +617,8 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha #ifndef OPENSSL_NO_HEARTBEATS /* Add Heartbeat extension */ + if ((limit - ret - 4 - 1) < 0) + return NULL; s2n(TLSEXT_TYPE_heartbeat,ret); s2n(1,ret); /* Set mode: @@ -844,6 +846,8 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha /* Add Heartbeat extension if we've received one */ if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) { + if ((limit - ret - 4 - 1) < 0) + return NULL; s2n(TLSEXT_TYPE_heartbeat,ret); s2n(1,ret); /* Set mode: -- 2.25.1