mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
8134d60565
mbedtls_ssl_parse_server_name_ext() used the first host_name entry and returned without looking at the rest of the extension. It accepted an empty server_name_list, a list that does not fill the extension, an empty host_name, a second host_name entry (forbidden by RFC 6066, section 3) and a malformed entry following the host_name, and it passed host names containing a null byte to the ServerName callback. Validate the whole list first, then record the host name and call the ServerName callback. Structural errors are rejected with a decode_error alert, a null byte in the host name with an unrecognized_name alert. Entries of unknown name types are still skipped, as RFC 6066 allows. Signed-off-by: Joachim Bauernberger <joachim.bauernberger@protonmail.com> |
||
|---|---|---|
| .. | ||
| mbedtls | ||
| .gitignore | ||
| CMakeLists.txt | ||