The branch OpenSSL_1_0_2-stable has been updated
via 77857ddcca41e1ad34725715fe7b32adc4de7930 (commit)
from cbffd2d9ca91dabb1cdfb181311f2a8458b4a8e8 (commit)
- Log -----------------------------------------------------------------
commit 77857ddcca41e1ad34725715fe7b32adc4de7930
Author: Matt Caswell <m...@openssl.org>
Date: Fri Jul 1 11:58:05 2016 +0100
Avoid an overflow in constructing the ServerKeyExchange message
We calculate the size required for the ServerKeyExchange message and then
call BUF_MEM_grow_clean() on the buffer. However we fail to take account of
2 bytes required for the signature algorithm and 2 bytes for the signature
length, i.e. we could overflow by 4 bytes. In reality this won't happen
because the buffer is pre-allocated to a large size that means it should be
big enough anyway.
Addresses an OCAP Audit issue.
Reviewed-by: Rich Salz <rs...@openssl.org>
-----------------------------------------------------------------------
Summary of changes:
ssl/s3_srvr.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 0c43c49..299f85b 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1872,6 +1872,11 @@ int ssl3_send_server_key_exchange(SSL *s)
goto f_err;
}
kn = EVP_PKEY_size(pkey);
+ /* Allow space for signature algorithm */
+ if (SSL_USE_SIGALGS(s))
+ kn += 2;
+ /* Allow space for signature length */
+ kn += 2;
} else {
pkey = NULL;
kn = 0;
_____
openssl-commits mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
