<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:宋体;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@宋体";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:华文细黑;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="2050" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi All,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In ssl3_write_bytes, if (len < tot) we are returning failure with SSL_R_BAD_LENGTH error. In this place I hope we should set “tot” back to “s->s3->wnum”. Otherwise when application calls back SSL_write with correct buffer, it causes serious
problem (“tot” is 0 and iLeft is not NULL). I hope we should do like below.<o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> if (len < tot) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:#00B050">s->s3->wnum = tot;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> SSLerr(SSL_F_SSL3_WRITE_BYTES, SSL_R_BAD_LENGTH);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> return (-1);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal">And also we should do one additional check for “len” as mentioned in my previous mail.<o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> if ((len < tot) || </span><span style="color:#00B050">((tot != 0) && (len < (tot + s->s3->wpend_tot)))</span><span style="color:#1F497D">){<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:#00B050">s->s3->wnum = tot;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> SSLerr(SSL_F_SSL3_WRITE_BYTES, SSL_R_BAD_LENGTH);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> return (-1);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Ashok<o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="color:#1F497D">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter" />
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0" />
<v:f eqn="sum @0 1 0" />
<v:f eqn="sum 0 0 @1" />
<v:f eqn="prod @2 1 2" />
<v:f eqn="prod @3 21600 pixelWidth" />
<v:f eqn="prod @3 21600 pixelHeight" />
<v:f eqn="sum @0 0 1" />
<v:f eqn="prod @6 1 2" />
<v:f eqn="prod @7 21600 pixelWidth" />
<v:f eqn="sum @8 21600 0" />
<v:f eqn="prod @7 21600 pixelHeight" />
<v:f eqn="sum @10 21600 0" />
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect" />
<o:lock v:ext="edit" aspectratio="t" />
</v:shapetype><v:shape id="_x0000_s1027" type="#_x0000_t75" alt="Company_logo" style='position:absolute;margin-left:0;margin-top:0;width:76.5pt;height:24pt;z-index:2;visibility:visible;mso-wrap-style:square;mso-wrap-distance-left:0;mso-wrap-distance-top:0;mso-wrap-distance-right:0;mso-wrap-distance-bottom:0;mso-position-horizontal:left;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:line' o:allowoverlap="f">
<v:imagedata src="cid:image002.jpg@01D2AA75.E944EE30" o:href="file:///C:\Users\r00902736\Application%20Data\Microsoft\Signatures\company_logo.jpg" />
<w:wrap type="square" anchory="line"/>
</v:shape><![endif]--><![if !vml]><img width="102" height="32" src="cid:image002.jpg@01D2AA75.E944EE30" align="left" alt="Company_logo" v:shapes="_x0000_s1027"><![endif]><span style="color:#1F497D"><br>
<br>
</span><span style="color:#595959">Raja Ashok V K</span><span style="font-size:10.0pt;color:#595959"><br>
</span><span style="color:#595959">Huawei Technologies<br>
Bangalore, India<br>
http://www.huawei.com <o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:宋体;color:#1F497D">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span lang="ZH-CN" style="font-size:7.5pt;font-family:宋体;color:gray">本邮件及其附件含有华为公司的保密信息，仅限于发送给上面地址中列出的个人或群组。禁</span><span style="font-size:7.5pt;font-family:华文细黑;color:gray"><br>
</span><span lang="ZH-CN" style="font-size:7.5pt;font-family:宋体;color:gray">止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制、或散发）本邮件中</span><span style="font-size:7.5pt;font-family:华文细黑;color:gray"><br>
</span><span lang="ZH-CN" style="font-size:7.5pt;font-family:宋体;color:gray">的信息。如果您错收了本邮件，请您立即电话或邮件通知发件人并删除本邮件！</span><span style="font-size:7.5pt;font-family:华文细黑;color:gray"><br>
</span><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">This e-mail and its attachments contain confidential information from HUAWEI, which
<br>
is intended only for the person or entity whose address is listed above. Any use of the
<br>
information contained herein in any way (including, but not limited to, total or partial
<br>
disclosure, reproduction, or dissemination) by persons other than the intended <br>
recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by
<br>
phone or email immediately and delete it!</span><span style="color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Raja ashok
<br>
<b>Sent:</b> 27 March 2017 13:55<br>
<b>To:</b> 'openssl-users@openssl.org'; 'openssl-dev@openssl.org'<br>
<b>Subject:</b> In ssl3_write_bytes, some checks related to hanlding write failure are missing<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I feel there is a check missing in ssl3_write_bytes, in case of handling write failure.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Consider SSL_write is called with 20000 bytes buffer, then internally in ssl3_write_bytes we try to send it as two record (16384 and 3616). If TCP send failed for the second record then we store the states internally (wnum, wpend_tot and
wpend_buf) and return back the result. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Later application has to call SSL_write with same buffer, if it calls with different buffer of length 100 byte then we fail that in ssl3_write_bytes using the check (len < tot).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But consider application calls with buffer of size 18000 bytes and SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER is enabled. Then (len < tot) will not succeed as tot is 16384. Then it will call ssl3_write_pending to send the remaining 3616 record.
If it succeeds we are incrementing tot, (tot += i). Now tot will have 20000.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Later there is a check (tot == len), this will not succeed. Then directly we are doing n = (len - tot), this will overflow and store a value close to 2^32 in n. Then it will cause out of bound access to the application buffer "buf".<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I hope we should have one more check (len < (tot + s->s3->wpend_tot)) before calling ssl3_write_pending.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#4F81BD"> if ((len < tot) ||</span><span style="color:#00B050"> (len < (tot + s->s3->wpend_tot))</span><span style="color:#4F81BD">){<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4F81BD"> SSLerr(SSL_F_SSL3_WRITE_BYTES, SSL_R_BAD_LENGTH);<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#4F81BD"> return (-1);<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:9.0pt"><span style="color:#4F81BD">}<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Note : I am referring 1.0.2k version of OpenSSL.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Ashok<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal"><!--[if gte vml 1]><v:shape id="ridImg" o:spid="_x0000_s1026" type="#_x0000_t75" alt="Company_logo" style='position:absolute;margin-left:0;margin-top:0;width:76.5pt;height:24pt;z-index:1;visibility:visible;mso-wrap-distance-left:0;mso-wrap-distance-right:0;mso-position-horizontal:left;mso-position-vertical-relative:line' o:allowoverlap="f">
<v:imagedata src="cid:image002.jpg@01D2AA75.E944EE30" o:title="company_logo" />
<w:wrap type="square"/>
</v:shape><![endif]--><![if !vml]><img width="102" height="32" src="cid:image002.jpg@01D2AA75.E944EE30" align="left" alt="Company_logo" v:shapes="ridImg"><![endif]><br>
<br>
<span style="color:#595959">Raja Ashok V K</span><span style="font-size:10.0pt;color:#595959"><br>
</span><span style="color:#595959">Huawei Technologies<br>
Bangalore, India<br>
<a href="http://www.huawei.com">http://www.huawei.com</a> <o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:宋体">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span lang="ZH-CN" style="font-size:7.5pt;font-family:宋体;color:gray">本邮件及其附件含有华为公司的保密信息，仅限于发送给上面地址中列出的个人或群组。禁</span><span style="font-size:7.5pt;font-family:华文细黑;color:gray"><br>
</span><span lang="ZH-CN" style="font-size:7.5pt;font-family:宋体;color:gray">止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制、或散发）本邮件中</span><span style="font-size:7.5pt;font-family:华文细黑;color:gray"><br>
</span><span lang="ZH-CN" style="font-size:7.5pt;font-family:宋体;color:gray">的信息。如果您错收了本邮件，请您立即电话或邮件通知发件人并删除本邮件！</span><span style="font-size:7.5pt;font-family:华文细黑;color:gray"><br>
</span><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">This e-mail and its attachments contain confidential information from HUAWEI, which
<br>
is intended only for the person or entity whose address is listed above. Any use of the
<br>
information contained herein in any way (including, but not limited to, total or partial
<br>
disclosure, reproduction, or dissemination) by persons other than the intended <br>
recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by
<br>
phone or email immediately and delete it!</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>