commit 9aec1c71f2055c742ba854359cbc25f302224e14
author Waleed Elmelegy <waleed.elmelegy@arm.com> Tue Dec 05 20:08:51 2023 +0000
committer Waleed Elmelegy <waleed.elmelegy@arm.com> Wed Dec 06 15:18:15 2023 +0000
tree ac71312311ab392b2d204686e9bc378ba90af946
parent f482dcc6c7a6003a86a69948f1f05f4e9490967e

Add record size checking during handshake

Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>

library/ssl_msg.c

diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 6579c96..29518c3 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -917,6 +917,7 @@
 #endif
     size_t add_data_len;
     size_t post_avail;
+    int max_out_record_len = mbedtls_ssl_get_max_out_record_payload(ssl);
 
     /* The SSL context is only used for debugging purposes! */
 #if !defined(MBEDTLS_DEBUG_C)
@@ -957,11 +958,11 @@
     MBEDTLS_SSL_DEBUG_BUF(4, "before encrypt: output payload",
                           data, rec->data_len);
 
-    if (rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN) {
+    if (rec->data_len > (size_t) max_out_record_len) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("Record content %" MBEDTLS_PRINTF_SIZET
                                   " too large, maximum %" MBEDTLS_PRINTF_SIZET,
                                   rec->data_len,
-                                  (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN));
+                                  (size_t) max_out_record_len));
         return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
     }
 
@@ -2742,7 +2743,7 @@
      *    ...
      */
     *buf = ssl->out_msg + 4;
-    *buf_len = MBEDTLS_SSL_OUT_CONTENT_LEN - 4;
+    *buf_len = mbedtls_ssl_get_max_out_record_payload(ssl) - 4;
 
     ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
     ssl->out_msg[0]  = hs_type;
@@ -2779,6 +2780,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     const size_t hs_len = ssl->out_msglen - 4;
     const unsigned char hs_type = ssl->out_msg[0];
+    int max_out_record_len = mbedtls_ssl_get_max_out_record_payload(ssl);
 
     MBEDTLS_SSL_DEBUG_MSG(2, ("=> write handshake message"));
 
@@ -2817,12 +2819,12 @@
      *
      * Note: We deliberately do not check for the MTU or MFL here.
      */
-    if (ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN) {
+    if (ssl->out_msglen > (size_t) max_out_record_len) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("Record too large: "
                                   "size %" MBEDTLS_PRINTF_SIZET
                                   ", maximum %" MBEDTLS_PRINTF_SIZET,
                                   ssl->out_msglen,
-                                  (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN));
+                                  (size_t) max_out_record_len));
         return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
     }