commit 066c1f60bba9fe447e8aeaddd11f18e838f7ed78
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Thu Oct 23 14:58:09 2014 +0200
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Thu Oct 23 14:58:09 2014 +0200
tree 9b7bbcc336a68e4de425db91398a5a19c85d5935
parent 6b440389136afbcb0d831f880176c830bd3e0c7c

Fix potential bad read in parsing ServerHello

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 15fc554..032e506 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -377,7 +377,7 @@
 #endif
     int ret, i, comp;
     size_t n;
-    size_t ext_len = 0;
+    size_t ext_len;
     unsigned char *buf, *ext;
     int renegotiation_info_seen = 0;
     int handshake_failure = 0;
@@ -464,7 +464,7 @@
      *   42+n . 43+n  extensions length
      *   44+n . 44+n+m extensions
      */
-    if( ssl->in_hslen > 42 + n )
+    if( ssl->in_hslen > 43 + n )
     {
         ext_len = ( ( buf[42 + n] <<  8 )
                   | ( buf[43 + n]       ) );
@@ -476,6 +476,15 @@
             return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
         }
     }
+    else if( ssl->in_hslen == 42 + n )
+    {
+        ext_len = 0;
+    }
+    else
+    {
+        SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
+        return( POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO );
+    }
 
     i = ( buf[39 + n] << 8 ) | buf[40 + n];
     comp = buf[41 + n];