From ccebf6ef8a90ecc17ac91c53caab25b1ad8ff42c Mon Sep 17 00:00:00 2001 From: Paul Bakker Date: Wed, 30 Apr 2014 14:38:05 +0200 Subject: [PATCH] Sanity length checks in ssl_read_record() and ssl_fetch_input() Both are already covered in other places, but not in a clear fashion. So for instance Coverity thinks the value is still tainted. --- library/ssl_tls.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 9c896b316..6e37836fc 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -1725,6 +1725,12 @@ int ssl_fetch_input( ssl_context *ssl, size_t nb_want ) SSL_DEBUG_MSG( 2, ( "=> fetch input" ) ); + if( nb_want > SSL_BUFFER_LEN - 8 ) + { + SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) ); + return( POLARSSL_ERR_SSL_BAD_INPUT_DATA ); + } + while( ssl->in_left < nb_want ) { len = nb_want - ssl->in_left; @@ -1959,13 +1965,20 @@ int ssl_read_record( ssl_context *ssl ) return( POLARSSL_ERR_SSL_INVALID_RECORD ); } + /* Sanity check (outer boundaries) */ + if( ssl->in_msglen < 1 || ssl->in_msglen > SSL_BUFFER_LEN - 13 ) + { + SSL_DEBUG_MSG( 1, ( "bad message length" ) ); + return( POLARSSL_ERR_SSL_INVALID_RECORD ); + } + /* - * Make sure the message length is acceptable + * Make sure the message length is acceptable for the current transform + * and protocol version. */ if( ssl->transform_in == NULL ) { - if( ssl->in_msglen < 1 || - ssl->in_msglen > SSL_MAX_CONTENT_LEN ) + if( ssl->in_msglen > SSL_MAX_CONTENT_LEN ) { SSL_DEBUG_MSG( 1, ( "bad message length" ) ); return( POLARSSL_ERR_SSL_INVALID_RECORD );