coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix memory errors in sample programs

Browse Source 
Fix two memory safety issues in sample programs (not in the library):

1. ssl_server2.c: Add length check in dummy_ticket_parse() to prevent
   size_t underflow when len < 4. Previously, 'len - 4' would wrap
   around for short tickets, causing out-of-bounds reads.

2. ssl_context_info.c: Replace strlen() with memchr() in ALPN parsing
   to avoid reading past the alpn_len boundary. strlen() on unbounded
   data could read beyond the decoded buffer.

Both issues were in sample programs, not the library itself, but should
still be fixed to avoid confusion in future investigations.

Fixes #10803
This commit is contained in:
Mustafa Senoglu 2026-07-13 14:20:18 +03:00
parent 9e9eb069d6
commit 247c860b8e
No known key found for this signature in database
GPG Key ID: B8F8BCD04E407C18
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
programs/ssl/ssl_context_info.c
View File

@ -882,8 +882,8 @@ static void print_deserialized_ssl_context(const uint8_t *ssl, size_t len)
printf("\tALPN negotiation : ");
CHECK_SSL_END(alpn_len);
if (alpn_len > 0) {
if (strlen((const char *) ssl) == alpn_len) {
printf("%s\n", ssl);
if (memchr(ssl, '\0', alpn_len) == NULL) {
printf("%.*s\n", alpn_len, ssl);
} else {
printf("\n");
printf_err("\tALPN negotiation is incorrect\n");

4
programs/ssl/ssl_server2.c
View File

@ -1385,6 +1385,10 @@ static int dummy_ticket_parse(void *p_ticket, mbedtls_ssl_session *session,
int ret;
((void) p_ticket);
if (len < 4) {
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
}
if ((ret = mbedtls_ssl_session_load(session, buf + 4, len - 4)) != 0) {
return ret;
}