mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-11-10 23:30:11 +08:00
c2c8d1e142
The serialized ALPN length was passed to memcmp() against each configured protocol without checking it against the remaining serialized data, so a malformed context could read past the end of the buffer. Bound it before the comparison, like the adjacent CID fields. Signed-off-by: Naveed <naveed@bugqore.com>
5 lines
196 B
Plaintext
5 lines
196 B
Plaintext
Bugfix
|
|
* Reject serialized SSL contexts whose ALPN protocol length exceeds the
|
|
remaining serialized data, instead of reading past the end of the buffer
|
|
in mbedtls_ssl_context_load().
|