bound two-byte length reads in tls 1.2 handshake parsing

Signed-off-by: Naveed <naveed@bugqore.com>

ChangeLog.d/tls12-handshake-length-read-bounds.txt

@@ -0,0 +1,6 @@
+Bugfix
+   * Fix a one-byte buffer over-read when parsing a TLS 1.2 ClientHello or
+     CertificateRequest. The length checks preceding the ciphersuite-list
+     length (server side) and the certificate-authorities length (client
+     side) reserved one byte too few, so a truncated message could cause the
+     two-byte length field to be read one byte past the end of the message.

library/ssl_tls12_client.c

@@ -2278,6 +2278,16 @@ static int ssl_parse_certificate_request(mbedtls_ssl_context *ssl)
 
     n += 2 + sig_alg_len;
 
+    /* The signature-algorithms check above leaves room for only one of the two
+     * distinguished-name length bytes, so make sure both are in the message
+     * before reading them. */
+    if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 3 + n) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate request message"));
+        mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                       MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
+        return MBEDTLS_ERR_SSL_DECODE_ERROR;
+    }
+
     /* certificate_authorities */
     dn_len = MBEDTLS_GET_UINT16_BE(buf, mbedtls_ssl_hs_hdr_len(ssl) + 1 + n);
 

library/ssl_tls12_server.c

@@ -1085,6 +1085,16 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
     ciph_offset = 35 + sess_len;
 
+    /* The two-byte ciphersuite list length field must be within the message.
+     * The DTLS branch above reserves it via the cookie length check; the
+     * session id length check does not, so guard the read here. */
+    if (ciph_offset + 2 > msg_len) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
+        mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                       MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
+        return MBEDTLS_ERR_SSL_DECODE_ERROR;
+    }
+
     ciph_len = MBEDTLS_GET_UINT16_BE(buf, ciph_offset);
 
     if (ciph_len < 2 ||