From 247c860b8e84dff813dd3f7abdf30a94271ac055 Mon Sep 17 00:00:00 2001 From: Mustafa Senoglu Date: Mon, 13 Jul 2026 14:20:18 +0300 Subject: [PATCH] Fix memory errors in sample programs Fix two memory safety issues in sample programs (not in the library): 1. ssl_server2.c: Add length check in dummy_ticket_parse() to prevent size_t underflow when len < 4. Previously, 'len - 4' would wrap around for short tickets, causing out-of-bounds reads. 2. ssl_context_info.c: Replace strlen() with memchr() in ALPN parsing to avoid reading past the alpn_len boundary. strlen() on unbounded data could read beyond the decoded buffer. Both issues were in sample programs, not the library itself, but should still be fixed to avoid confusion in future investigations. Fixes #10803 --- programs/ssl/ssl_context_info.c | 4 ++-- programs/ssl/ssl_server2.c | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/programs/ssl/ssl_context_info.c b/programs/ssl/ssl_context_info.c index 9d7fb99e09..7f90c828ba 100644 --- a/programs/ssl/ssl_context_info.c +++ b/programs/ssl/ssl_context_info.c @@ -882,8 +882,8 @@ static void print_deserialized_ssl_context(const uint8_t *ssl, size_t len) printf("\tALPN negotiation : "); CHECK_SSL_END(alpn_len); if (alpn_len > 0) { - if (strlen((const char *) ssl) == alpn_len) { - printf("%s\n", ssl); + if (memchr(ssl, '\0', alpn_len) == NULL) { + printf("%.*s\n", alpn_len, ssl); } else { printf("\n"); printf_err("\tALPN negotiation is incorrect\n"); diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index b5cdc817b8..7de63f5520 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -1385,6 +1385,10 @@ static int dummy_ticket_parse(void *p_ticket, mbedtls_ssl_session *session, int ret; ((void) p_ticket); + if (len < 4) { + return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; + } + if ((ret = mbedtls_ssl_session_load(session, buf + 4, len - 4)) != 0) { return ret; }