OpenSSL: openssl/ssl/ t1_lib.c

  OpenSSL CVS Repository
  http://cvs.openssl.org/
 
____________________________________________________________
________________

  Server: cvs.openssl.org                  Name:   Bodo
Moeller
  Root:   /v/openssl/cvs                   Email:  bodoopenssl.org
  Module: openssl                          Date:  
30-Mar-2006 04:53:30
  Branch: HEAD                             Handle:
2006033003533000

  Modified files:
    openssl/ssl             t1_lib.c

  Log:
    fix for hostname extension
    
    Submitted by: Kaspar Brand, Peter Sylvester

  Summary:
    Revision    Changes     Path
    1.32        +51 -18     openssl/ssl/t1_lib.c
 
____________________________________________________________
________________

  patch -p0 <<' .'
  Index: openssl/ssl/t1_lib.c
 
============================================================
================
  $ cvs diff -u -r1.31 -r1.32 t1_lib.c
  --- openssl/ssl/t1_lib.c	30 Mar 2006 02:44:56 -0000	1.31
  +++ openssl/ssl/t1_lib.c	30 Mar 2006 02:53:30 -0000	1.32
   -164,22 +164,37 
   	ret+=2;
   
   	if (ret>=limit) return NULL; /* this really never
occurs, but ... */
  - 	if (s->servername_done == 0 &&
s->tlsext_hostname != NULL)
  + 	if (s->tlsext_hostname != NULL)
   		{ 
   		/* Add TLS extension servername to the Client Hello
message */
   		unsigned long size_str;
   		long lenmax; 
   
  -		if ((lenmax = limit - p - 7) < 0) return NULL; 
  -		if ((size_str = strlen(s->tlsext_hostname)) >
(unsigned long)lenmax) return NULL;
  +		/* check for enough space.
  +                   4 for the servername type and
entension length
  +                   2 for servernamelist length
  +                   1 for the hostname type
  +                   2 for hostname length
  +                   + hostname length 
  +		*/
  +                   
  +		if ((lenmax = limit - p - 9) < 0 
  +		|| (size_str = strlen(s->tlsext_hostname)) >
(unsigned long)lenmax) 
  +			return NULL;
  +			
  +		/* extension type and length */
  +		s2n(TLSEXT_TYPE_server_name,ret); 
  +		s2n(size_str+5,ret);
   		
  -		s2n(TLSEXT_TYPE_server_name,ret);
  +		/* length of servername list */
   		s2n(size_str+3,ret);
  +	
  +		/* hostname type, length and hostname */
   		*(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
   		s2n(size_str,ret);
  -	
   		memcpy(ret, s->tlsext_hostname, size_str);
   		ret+=size_str;
  +
   		}
   #ifndef OPENSSL_NO_EC
   	if (s->tlsext_ecpointformatlist != NULL)
   -264,6 +279,7 
   		*(ret++) = (unsigned char)
s->tlsext_ecpointformatlist_length;
   		memcpy(ret, s->tlsext_ecpointformatlist,
s->tlsext_ecpointformatlist_length);
   		ret+=s->tlsext_ecpointformatlist_length;
  +
   		}
   	/* Currently the server should not respond with a
SupportedCurves extension */
   #endif /* OPENSSL_NO_EC */
   -281,9 +297,6 
   	unsigned short size;
   	unsigned short len;
   	unsigned char *data = *p;
  -#if 0
  -	fprintf(stderr,"ssl_parse_clienthello_tlsext
%s\n",s->session->tlsext_hostname?s->session
->tlsext_hostname:"NULL");
  -#endif
   	s->servername_done = 0;
   
   	if (data >= (d+n-2))
   -326,20 +339,36 
   
   		if (type == TLSEXT_TYPE_server_name)
   			{
  -			unsigned char *sdata = data;
  +			unsigned char *sdata;
   			int servname_type;
  -			int dsize = size-3 ;
  -                        
  -			if (dsize > 0 )
  +			int dsize; 
  +		
  +			if (size < 2) 
  +				{
  +				*al = SSL_AD_DECODE_ERROR;
  +				return 0;
  +				}
  +			n2s(data,dsize);  
  +			size -= 2;                    
  +			if (dsize > size  ) 
   				{
  - 				servname_type = *(sdata++); 
  +				*al = SSL_AD_DECODE_ERROR;
  +				return 0;
  +				} 
  +
  +			sdata = data;
  +			while (dsize > 3) 
  +				{
  +	 			servname_type = *(sdata++); 
   				n2s(sdata,len);
  -				if (len != dsize) 
  +				dsize -= 3;
  +
  +				if (len > dsize) 
   					{
   					*al = SSL_AD_DECODE_ERROR;
   					return 0;
   					}
  -
  +				if (s->servername_done == 0)
   				switch (servname_type)
   					{
   				case TLSEXT_NAMETYPE_host_name:
   -360,9 +389,6 
   						}
   						s->servername_done = 1; 
   
  -#if 0
  -						fprintf(stderr,"ssl_parse_clienthello_tlsext
s->session->tlsext_hostname
%s\n",s->session->tlsext_hostname);
  -#endif
   						}
   					else 
   						s->servername_done =
strlen(s->session->tlsext_hostname) == len 
   -374,7 +400,14 
   					break;
   					}
                                    
  +				dsize -= len;
  +				}
  +			if (dsize != 0) 
  +				{
  +				*al = SSL_AD_DECODE_ERROR;
  +				return 0;
   				}
  +
   			}
   
   #ifndef OPENSSL_NO_EC
   .
____________________________________________________________
__________
OpenSSL Project                                 http://www.openssl.org
CVS Repository Commit List                    
openssl-cvsopenssl.org
Automated List Manager                          
majordomoopenssl.org