eden-emu/mbedtls
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

- Fixed potential memory corruption on miscrafted client messages (found by Frama-C team at CEA LIST)

Browse source
This commit is contained in:
Paul Bakker 2012-04-05 12:07:34 +00:00
parent 6126481796
commit 452d532955
2 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
library/ssl_tls.c
View file

@ -880,6 +880,13 @@ static int ssl_decrypt_buf( ssl_context *ssl )
/*
* Always compute the MAC (RFC4346, CBCTIME).
*/
if( ssl->in_msglen <= ssl->maclen + padlen )
{
SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
ssl->in_msglen, ssl->maclen, padlen ) );
return( POLARSSL_ERR_SSL_INVALID_MAC );
}
ssl->in_msglen -= ( ssl->maclen + padlen );
ssl->in_hdr[3] = (unsigned char)( ssl->in_msglen >> 8 );