mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-11-09 14:50:17 +08:00
f0422f56d1
mbedtls_ssl_conf_alpn_protocols() validates that no individual protocol name is empty or too long, but never checked that the list itself has at least one entry. Configuring an empty list (a NULL-terminated array whose first element is already NULL) was silently accepted, and the list is later used as-is by ssl_write_alpn_ext() to build the ALPN extension - producing a protocol_name_list of length 0. RFC 7301 3.1 requires the ALPN extension's protocol_name_list to contain at least one entry; a zero-length list is not a valid encoding. Peers that correctly validate the extension respond with a fatal decode_error alert, breaking the handshake. Reject an empty list up front with MBEDTLS_ERR_SSL_BAD_INPUT_DATA, matching how this function already rejects other invalid inputs (empty individual protocol names, names or total length exceeding the configured maximums). Fixes #10461 Signed-off-by: yi chen <94xhn1@gmail.com>
8 lines
424 B
Plaintext
8 lines
424 B
Plaintext
Bugfix
|
|
* Fix mbedtls_ssl_conf_alpn_protocols() silently accepting an empty
|
|
protocol list, which caused an invalid ALPN extension with a
|
|
zero-length protocol_name_list to be sent during the handshake,
|
|
violating RFC 7301 and causing conforming peers to reject the
|
|
connection with a fatal decode error. mbedtls_ssl_conf_alpn_protocols()
|
|
now returns MBEDTLS_ERR_SSL_BAD_INPUT_DATA for an empty list.
|