[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[bernd.edlinger at hotmail.de]

The branch OpenSSL_1_0_2-stable has been updated
       via  46c815a97d21135561d2204574bbd7c184b1f0b5 (commit)
      from  f3f8e72f494b36d05e0d04fe418f92b692fbb261 (commit)


- Log -----------------------------------------------------------------
commit 46c815a97d21135561d2204574bbd7c184b1f0b5
Author: Philippe Antoine <p.antoine at catenacyber.fr>
Date:   Mon Mar 26 10:25:55 2018 +0200

    Adds multiple checks to avoid buffer over reads
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Bernd Edlinger <bernd.edlinger at hotmail.de>
    (Merged from https://github.com/openssl/openssl/pull/5687)

-----------------------------------------------------------------------

Summary of changes:
 ssl/t1_trce.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/ssl/t1_trce.c b/ssl/t1_trce.c
index dc62df8..8a5707a 100644
--- a/ssl/t1_trce.c
+++ b/ssl/t1_trce.c
@@ -645,6 +645,8 @@ static int ssl_print_extensions(BIO *bio, int indent, int server,
         BIO_puts(bio, "No Extensions\n");
         return 1;
     }
+    if (msglen < 2)
+        return 0;
     extslen = (msg[0] << 8) | msg[1];
     if (extslen != msglen - 2)
         return 0;
@@ -1021,6 +1023,8 @@ static int ssl_print_cert_request(BIO *bio, int indent, SSL *s,
     msglen -= xlen + 2;
 
  skip_sig:
+    if (msglen < 2)
+        return 0;
     xlen = (msg[0] << 8) | msg[1];
     BIO_indent(bio, indent, 80);
     if (msglen < xlen + 2)
@@ -1209,7 +1213,15 @@ void SSL_trace(int write_p, int version, int content_type,
     switch (content_type) {
     case SSL3_RT_HEADER:
         {
-            int hvers = msg[1] << 8 | msg[2];
+            int hvers;
+
+            /* avoid overlapping with length at the end of buffer */
+            if (msglen < (SSL_IS_DTLS(ssl) ? 13 : 5)) {
+                        BIO_puts(bio, write_p ? "Sent" : "Received");
+                        ssl_print_hex(bio, 0, " too short message", msg, msglen);
+                        break;
+                    }
+            hvers = msg[1] << 8 | msg[2];
             BIO_puts(bio, write_p ? "Sent" : "Received");
             BIO_printf(bio, " Record\nHeader:\n  Version = %s (0x%x)\n",
                        ssl_trace_str(hvers, ssl_version_tbl), hvers);