mirror of
https://github.com/cuberite/polarssl.git
synced 2025-10-17 12:10:43 -04:00
e6487ab490
Co-authored-by: Gilles Peskine <Gilles.Peskine@arm.com> Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
12 lines
711 B
Plaintext
12 lines
711 B
Plaintext
Security
|
|
* Fix a buffer overread in DTLS ClientHello parsing in servers with
|
|
MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled. An unauthenticated client
|
|
or a man-in-the-middle could cause a DTLS server to read up to 255 bytes
|
|
after the end of the SSL input buffer. The buffer overread only happens
|
|
when MBEDTLS_SSL_IN_CONTENT_LEN is less than a threshold that depends on
|
|
the exact configuration: 258 bytes if using mbedtls_ssl_cookie_check(),
|
|
and possibly up to 571 bytes with a custom cookie check function.
|
|
If the function provider deliberately omits these size checks, he/she
|
|
is responsible for the negative impact on his/her code.
|
|
Reported by the Cybeats PSI Team.
|