mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
a3c9450cd2
The corrupted in_cid length exercised the pre-existing size-cap check, not the bounds check: the in_cid field is not the last one serialized, and the MBEDTLS_SSL_CID_IN_LEN_MAX cap is smaller than the size of the fields that follow it, so no corrupted length could reach past the end of the full buffer, and reverting the bounds check did not change the test's outcome. Truncate the loaded data right after the in_cid bytes, load from a tightly allocated copy, and corrupt the length to one byte past that end, so that reverting the bounds check now trips ASan with an out-of-bounds read in the memcpy(), like the ALPN case. Signed-off-by: Naveed <naveed@bugqore.com> |
||
|---|---|---|
| .. | ||
| .jenkins | ||
| configs | ||
| git-scripts | ||
| include/test | ||
| opt-testcases | ||
| scripts | ||
| src | ||
| suites | ||
| .gitignore | ||
| CMakeLists.txt | ||
| compat-in-docker.sh | ||
| compat.sh | ||
| context-info.sh | ||
| Descriptions.txt | ||
| make-in-docker.sh | ||
| Makefile | ||
| ssl-opt.sh | ||