mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-07-31 00:37:08 +08:00
247c860b8e
Fix two memory safety issues in sample programs (not in the library): 1. ssl_server2.c: Add length check in dummy_ticket_parse() to prevent size_t underflow when len < 4. Previously, 'len - 4' would wrap around for short tickets, causing out-of-bounds reads. 2. ssl_context_info.c: Replace strlen() with memchr() in ALPN parsing to avoid reading past the alpn_len boundary. strlen() on unbounded data could read beyond the decoded buffer. Both issues were in sample programs, not the library itself, but should still be fixed to avoid confusion in future investigations. Fixes #10803 |
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| dtls_client.c | ||
| dtls_server.c | ||
| mini_client.c | ||
| ssl_client1.c | ||
| ssl_client2.c | ||
| ssl_context_info.c | ||
| ssl_fork_server.c | ||
| ssl_mail_client.c | ||
| ssl_pthread_server.c | ||
| ssl_server2.c | ||
| ssl_server.c | ||
| ssl_test_common_source.c | ||
| ssl_test_lib.c | ||
| ssl_test_lib.h | ||