diff options
author | marha <marha@users.sourceforge.net> | 2015-06-15 20:18:50 +0200 |
---|---|---|
committer | Mike DePaulo <mikedep333@gmail.com> | 2015-06-22 01:39:02 -0400 |
commit | 76d3cb65aed1b2e454d129eb1e187e896f5e3a2a (patch) | |
tree | bca8e882abc81afce4770da47751e08f1bbeecec /openssl/ssl/s2_pkt.c | |
parent | df30d2b2322d7940e83be76b63ce6f5a5a77f5b3 (diff) | |
download | vcxsrv-76d3cb65aed1b2e454d129eb1e187e896f5e3a2a.tar.gz vcxsrv-76d3cb65aed1b2e454d129eb1e187e896f5e3a2a.tar.bz2 vcxsrv-76d3cb65aed1b2e454d129eb1e187e896f5e3a2a.zip |
Update to openssl-1.0.2c
Conflicts:
openssl/Makefile
Diffstat (limited to 'openssl/ssl/s2_pkt.c')
-rw-r--r-- | openssl/ssl/s2_pkt.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/openssl/ssl/s2_pkt.c b/openssl/ssl/s2_pkt.c index 614b9a35d..7a6188813 100644 --- a/openssl/ssl/s2_pkt.c +++ b/openssl/ssl/s2_pkt.c @@ -576,6 +576,20 @@ static int n_do_ssl_write(SSL *s, const unsigned char *buf, unsigned int len) s->s2->padding = p; s->s2->mac_data = &(s->s2->wbuf[3]); s->s2->wact_data = &(s->s2->wbuf[3 + mac_size]); + + /* + * It would be clearer to write this as follows: + * if (mac_size + len + p > SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER) + * However |len| is user input that could in theory be very large. We + * know |mac_size| and |p| are small, so to avoid any possibility of + * overflow we write it like this. + * + * In theory this should never fail because the logic above should have + * modified |len| if it is too big. But we are being cautious. + */ + if (len > (SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER - (mac_size + p))) { + return -1; + } /* we copy the data into s->s2->wbuf */ memcpy(s->s2->wact_data, buf, len); if (p) |