From c8183cc4924e25a205db6f42150fd075cdeb83c8 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Mon, 6 Jun 2022 14:42:41 -0400 Subject: [PATCH] Add missing sid_len in calculations of cookie sizes This could lead to a potential buffer overread with small MBEDTLS_SSL_IN_CONTENT_LEN. Change the bound calculations so that it is apparent what lengths and sizes are used. Signed-off-by: Andrzej Kurek --- library/ssl_msg.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/library/ssl_msg.c b/library/ssl_msg.c index a77a1a821..da4dbc721 100644 --- a/library/ssl_msg.c +++ b/library/ssl_msg.c @@ -3205,7 +3205,7 @@ static int ssl_check_dtls_clihlo_cookie( } sid_len = in[59]; - if( sid_len > in_len - 61 ) + if( 59 + 1 + sid_len + 1 > in_len ) { MBEDTLS_SSL_DEBUG_MSG( 4, ( "check cookie: sid_len=%u > %u", (unsigned) sid_len, @@ -3216,10 +3216,11 @@ static int ssl_check_dtls_clihlo_cookie( in + 60, sid_len ); cookie_len = in[60 + sid_len]; - if( cookie_len > in_len - 60 ) { + if( 59 + 1 + sid_len + 1 + cookie_len > in_len ) + { MBEDTLS_SSL_DEBUG_MSG( 4, ( "check cookie: cookie_len=%u > %u", (unsigned) cookie_len, - (unsigned) in_len - 60 ) ); + (unsigned) ( in_len - sid_len - 61 ) ) ); return( MBEDTLS_ERR_SSL_DECODE_ERROR ); }