mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
bccab06703
With the loaded data cut right after the in_cid bytes, even the pristine in_cid length tripped the (end - p) < in_cid_len + 1u bounds check, since the out_cid length byte it accounts for was missing: the truncation, not the corruption, was what got rejected. Keep the out_cid length byte in the loaded data, so the pristine length passes the check and only the corrupted length trips it. Also document why this pre-existing check is the only one in the in_cid path that a regression test can guard: the in_cid_len > sizeof(in_cid) cap protects the memcpy() destination, and without it the overflow lands in the out_cid field inside the transform structure, where sanitizers cannot see it. Signed-off-by: Naveed <naveed@bugqore.com> |
||
|---|---|---|
| .. | ||
| test_suite_config.function | ||
| test_suite_config.tls_combinations.data | ||
| test_suite_constant_time_hmac.data | ||
| test_suite_constant_time_hmac.function | ||
| test_suite_debug.data | ||
| test_suite_debug.function | ||
| test_suite_error.data | ||
| test_suite_error.function | ||
| test_suite_mps.data | ||
| test_suite_mps.function | ||
| test_suite_net.data | ||
| test_suite_net.function | ||
| test_suite_pkcs7.data | ||
| test_suite_pkcs7.function | ||
| test_suite_ssl_decrypt.function | ||
| test_suite_ssl_decrypt.misc.data | ||
| test_suite_ssl.data | ||
| test_suite_ssl.function | ||
| test_suite_ssl.records.data | ||
| test_suite_ssl.tls-defrag.data | ||
| test_suite_test_helpers.data | ||
| test_suite_test_helpers.function | ||
| test_suite_timing.data | ||
| test_suite_timing.function | ||
| test_suite_version.data | ||
| test_suite_version.function | ||
| test_suite_x509_oid.data | ||
| test_suite_x509_oid.function | ||
| test_suite_x509parse.data | ||
| test_suite_x509parse.function | ||
| test_suite_x509write.data | ||
| test_suite_x509write.function | ||