Hanno Becker 63c706f429
Fix bounds check in ssl_parse_server_psk_hint() ...
In the previous bounds check `(*p) > end - len`, the computation
of `end - len` might underflow if `end` is within the first 64KB
of the address space (note that the length `len` is controlled by
the peer). In this case, the bounds check will be bypassed, leading
to `*p` exceed the message bounds by up to 64KB when leaving
`ssl_parse_server_psk_hint()`. In a pure PSK-based handshake,
this doesn't seem to have any consequences, as `*p*` is not accessed
afterwards. In a PSK-(EC)DHE handshake, however, `*p` is read from
in `ssl_parse_server_ecdh_params()` and `ssl_parse_server_dh_params()`
which might lead to an application crash of information leakage.
2018-10-08 13:53:51 +01:00
2015-06-25 10:59:56 +02:00
2018-02-21 19:16:20 +01:00
2016-05-23 14:29:28 +01:00
2016-05-23 14:29:32 +01:00
2016-10-13 13:54:14 +01:00
2018-06-12 17:40:08 +01:00
2017-02-15 23:31:07 +02:00
2018-03-09 10:48:12 +00:00
2016-05-23 14:29:32 +01:00
2016-06-07 14:52:35 +01:00
2018-07-30 11:43:08 +03:00
2017-07-27 21:44:33 +01:00
2015-09-04 14:21:07 +02:00
2018-06-28 08:44:47 +03:00
2018-06-27 11:11:34 +01:00
2018-08-31 16:07:23 +01:00
2018-02-10 11:11:41 +02:00
2017-09-06 17:51:14 +03:00
2016-05-23 14:29:32 +01:00
2018-01-26 18:43:04 +00:00
2017-10-10 19:04:27 +03:00
2018-03-30 18:43:16 +02:00
2018-06-08 11:14:43 +01:00
2017-05-11 22:42:14 +01:00
2018-07-26 11:08:06 +03:00
2016-06-12 00:31:33 +01:00
2018-01-25 17:28:31 +00:00
2018-03-30 18:52:10 +02:00
2018-01-02 16:24:29 +01:00
2016-05-23 23:18:26 +01:00
2017-06-26 10:22:24 +01:00
2018-04-01 12:41:29 +02:00
2018-02-22 08:20:42 +00:00
2018-02-22 08:20:42 +00:00
2018-07-12 10:18:37 +02:00
2018-01-22 11:54:42 +01:00
2018-01-25 17:28:31 +00:00
2018-05-23 16:32:33 +01:00
2018-06-14 11:01:14 +01:00
2018-02-08 17:18:15 +08:00
2015-09-04 14:21:07 +02:00
2018-03-12 23:44:56 +01:00
2018-03-30 18:43:16 +02:00
2017-08-04 13:32:15 +01:00
2018-05-25 14:58:33 +01:00
2015-09-04 14:21:07 +02:00
2016-05-23 14:29:28 +01:00
2018-07-20 14:08:02 +02:00
2017-08-23 16:17:27 +01:00
2018-03-11 00:48:17 +01:00
2018-02-22 08:20:42 +00:00
2018-01-03 09:27:40 +00:00
2018-03-23 02:12:44 +01:00
2018-07-12 10:18:37 +02:00
2018-07-12 10:18:37 +02:00
2018-07-12 10:18:37 +02:00
2017-10-29 17:53:52 +02:00
2018-06-28 15:49:34 +03:00
2018-10-08 13:53:51 +01:00
2017-03-02 12:26:11 +00:00
2018-08-10 11:01:29 +01:00
2018-08-22 14:58:31 +01:00
2018-08-28 15:34:28 +01:00
2018-03-21 15:13:08 +00:00
2018-01-29 10:24:50 +01:00
2018-02-22 16:07:32 +01:00
2015-09-04 14:21:07 +02:00
2015-10-21 12:50:45 +02:00
2018-03-14 09:24:12 +01:00
2018-08-28 15:29:55 +01:00
2018-06-22 11:45:38 +01:00
2018-07-02 12:13:26 +01:00
2018-01-22 11:54:42 +01:00
2017-09-22 16:05:43 +01:00
2015-09-04 14:21:07 +02:00
63c706f429