In recv_record of tls.c, the 16-bit record-length field of an incoming TLS record is validated only against the generic TLS_RX_BUF constant (8192 bytes) rather than the actual capacity of the caller-supplied destination buffer. Two call sites in tls_connect(), used to receive the server's ChangeCipherSpec and Finished handshake messages, pass stack buffers of only 8 and 512 bytes respectively. A malicious or compromised TLS server can declare a record length up to 8192 bytes and have that many attacker-controlled bytes written past the end of either stack buffer, corrupting the stack of tls_connect()'s frame. This is reachable by initiating any outbound HTTPS connection (e.g. via wget) to a server under the attacker's control.
CWE-121, CWE-20
Artfical DT Developer Talha Berk Arslan