mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
13bbd7ec0b
With the loaded data cut right after the in_cid bytes, even the pristine in_cid length tripped the (end - p) < in_cid_len + 1u bounds check, since the out_cid length byte it accounts for was missing: the truncation, not the corruption, was what got rejected. Keep the out_cid length byte in the loaded data, so the pristine length passes the check and only the corrupted length trips it. Also document why this pre-existing check is the only one in the in_cid path that a regression test can guard: the in_cid_len > sizeof(in_cid) cap protects the memcpy() destination, and without it the overflow lands in the out_cid field inside the transform structure, where sanitizers cannot see it. Signed-off-by: Naveed <naveed@bugqore.com> |
||
|---|---|---|
| .. | ||
| .jenkins | ||
| configs | ||
| git-scripts | ||
| include/test | ||
| opt-testcases | ||
| scripts | ||
| src | ||
| suites | ||
| .gitignore | ||
| CMakeLists.txt | ||
| compat-in-docker.sh | ||
| compat.sh | ||
| context-info.sh | ||
| Descriptions.txt | ||
| make-in-docker.sh | ||
| Makefile | ||
| ssl-opt.sh | ||