CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/08/29 02:41:17
Modified files:
lib/libssl : ssl_clnt.c ssl_srvr.c
Log message:
libssl: fix API misuse in legacy finished handling
This looks like a potential out of bounds read or allowing trailing garbage
in peer_finished. It's harmless because CBS_len() is compared against the
s->s3->hs.peer_finished_len a few lines up, thus it is only cosmetic.
discussed with jsing
ok kenjiro
