[openssl-commits] [openssl] OpenSSL_1_0_0-stable update

[Matt Caswell]

The branch OpenSSL_1_0_0-stable has been updated
       via  4bbff0f946a10f748fba3fe1bda8bbaa6d7e0d12 (commit)
      from  923552bd5de08997523bd6d25323217fab5e83be (commit)


- Log -----------------------------------------------------------------
commit 4bbff0f946a10f748fba3fe1bda8bbaa6d7e0d12
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Apr 10 16:49:33 2015 +0100

    Fix ssl_get_prev_session overrun
    
    If OpenSSL is configured with no-tlsext then ssl_get_prev_session can read
    past the end of the ClientHello message if the session_id length in the
    ClientHello is invalid. This should not cause any security issues since the
    underlying buffer is 16k in size. It should never be possible to overrun by
    that many bytes.
    
    This is probably made redundant by the previous commit - but you can never be
    too careful.
    
    With thanks to Qinghao Tang for reporting this issue.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 5e0a80c1c9b2b06c2d203ad89778ce1b98e0b5ad)
    
    Conflicts:
    	ssl/ssl_sess.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_sess.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 1fc44c1..b9432fd 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -431,6 +431,12 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
 
     if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
         goto err;
+
+    if (session_id + len > limit) {
+        fatal = 1;
+        goto err;
+    }
+
 #ifndef OPENSSL_NO_TLSEXT
     r = tls1_process_ticket(s, session_id, len, limit, &ret);
     if (r == -1) {