[openssl-commits] [openssl] master update

[Matt Caswell]

The branch master has been updated
       via  e3ea3afd6d9cc05b207e76e49552f88ae28489c3 (commit)
      from  05ec6a25f80ac8edfb7d7cb764d2dd68156a6965 (commit)


- Log -----------------------------------------------------------------
commit e3ea3afd6d9cc05b207e76e49552f88ae28489c3
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Jul 18 13:49:38 2016 +0100

    Refactor Identity Hint handling
    
    Don't call strncpy with strlen of the source as the length. Don't call
    strlen multiple times. Eventually we will want to replace this with a proper
    PACKET style handling (but for construction of PACKETs instead of just
    reading them as it is now). For now though this is safe because
    PSK_MAX_IDENTITY_LEN will always fit into the destination buffer.
    
    This addresses an OCAP Audit issue.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/statem/statem_srvr.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index 82fced5..d38fc3a 100644
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -1830,10 +1830,19 @@ int tls_construct_server_key_exchange(SSL *s)
     if (type & SSL_PSK) {
         /* copy PSK identity hint */
         if (s->cert->psk_identity_hint) {
-            s2n(strlen(s->cert->psk_identity_hint), p);
-            strncpy((char *)p, s->cert->psk_identity_hint,
-                    strlen(s->cert->psk_identity_hint));
-            p += strlen(s->cert->psk_identity_hint);
+            size_t len = strlen(s->cert->psk_identity_hint);
+            if (len > PSK_MAX_IDENTITY_LEN) {
+                /*
+                 * Should not happen - we already checked this when we set
+                 * the identity hint
+                 */
+                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
+                       ERR_R_INTERNAL_ERROR);
+                goto err;
+            }
+            s2n(len, p);
+            memcpy(p, s->cert->psk_identity_hint, len);
+            p += len;
         } else {
             s2n(0, p);
         }