mirrors-yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls synced 2024-11-24 15:38:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fixed potential overflow in certificate size in ssl_write_certificate()

Browse source
This commit is contained in:
Paul Bakker 2013-12-31 11:35:16 +01:00
parent 6ea1a95ce8
commit 6992eb762c
2 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -32,6 +32,8 @@ Bugfix
* Fixed x509_crt_parse_path() bug on Windows platforms
* Added missing MPI_CHK() around some statements in mpi_div_mpi() (found by
TrustInSoft)
* Fixed potential overflow in certificate size verification in
ssl_write_certificate() (found by TrustInSoft)
Security
* Possible remotely-triggered out-of-bounds memory access fixed (found by

2
library/ssl_tls.c
View file

@ -2453,7 +2453,7 @@ int ssl_write_certificate( ssl_context *ssl )
while( crt != NULL )
{
n = crt->raw.len;
if( i + 3 + n > SSL_MAX_CONTENT_LEN )
if( n > SSL_MAX_CONTENT_LEN - 3 - i )
{
SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
i + 3 + n, SSL_MAX_CONTENT_LEN ) );