mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
258bbbbdb0
mbedtls_ssl_cookie_write() only reserves COOKIE_HMAC_LEN bytes for the MAC after the timestamp, but passed COOKIE_MD_OUTLEN as the output size to psa_mac_sign_finish(). PSA fills the unused part of the declared output buffer, so up to 4 bytes (20 with SHA-384) past the end of the caller's buffer were overwritten when it had less than that to spare. Pass the size that was actually reserved and add a regression test. Signed-off-by: Naveed <naveed@bugqore.com>
7 lines
335 B
Plaintext
7 lines
335 B
Plaintext
Bugfix
|
|
* Fix mbedtls_ssl_cookie_write() writing up to 20 bytes past the end of
|
|
the output buffer when less than 36 bytes (or 52 bytes when the cookie
|
|
uses SHA-384) were available. The library's own callers always leave
|
|
enough room, so only applications that call it directly with a smaller
|
|
buffer were affected.
|