From 1a1fbba1ae50add18a6668d7095062afcd8a6ce7 Mon Sep 17 00:00:00 2001 From: Paul Bakker Date: Wed, 30 Apr 2014 14:38:05 +0200 Subject: [PATCH] Sanity length checks in ssl_read_record() and ssl_fetch_input() Both are already covered in other places, but not in a clear fashion. So for instance Coverity thinks the value is still tainted. --- library/ssl_tls.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 271bfe605..e9b102467 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -1908,6 +1908,12 @@ int ssl_fetch_input( ssl_context *ssl, size_t nb_want ) SSL_DEBUG_MSG( 2, ( "=> fetch input" ) ); + if( nb_want > SSL_BUFFER_LEN - 8 ) + { + SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) ); + return( POLARSSL_ERR_SSL_BAD_INPUT_DATA ); + } + while( ssl->in_left < nb_want ) { len = nb_want - ssl->in_left; @@ -2131,13 +2137,20 @@ int ssl_read_record( ssl_context *ssl ) return( POLARSSL_ERR_SSL_INVALID_RECORD ); } + /* Sanity check (outer boundaries) */ + if( ssl->in_msglen < 1 || ssl->in_msglen > SSL_BUFFER_LEN - 13 ) + { + SSL_DEBUG_MSG( 1, ( "bad message length" ) ); + return( POLARSSL_ERR_SSL_INVALID_RECORD ); + } + /* - * Make sure the message length is acceptable + * Make sure the message length is acceptable for the current transform + * and protocol version. */ if( ssl->transform_in == NULL ) { - if( ssl->in_msglen < 1 || - ssl->in_msglen > SSL_MAX_CONTENT_LEN ) + if( ssl->in_msglen > SSL_MAX_CONTENT_LEN ) { SSL_DEBUG_MSG( 1, ( "bad message length" ) ); return( POLARSSL_ERR_SSL_INVALID_RECORD );