e97224f8f
Denys Vlasenko
2026-09-22
Subject
tls: fix off-by-one access past the end of the received packet.
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
networking/tls.c+4 -2
| @@ -2467,7 +2467,9 @@ static void get_client_hello(tls_state_t *tls) | |
| p += 2; | |
| len -= 2; | |
| - | if (len < cipher_list_len) { |
| + | if (len <= cipher_list_len) { |
| + | /* The "<=" is subtle: it aborts even if we do have cipher list, |
| + | * but have no compression size byte after it */ |
| bb_simple_error_msg_and_die("malformed ClientHello"); | |
| } | |
| @@ -2522,7 +2524,7 @@ static void get_client_hello(tls_state_t *tls) | |
| len -= cipher_list_len; | |
| /* Skip compression methods */ | |
| - | len -= 1 + p[0]; |
| + | len -= 1 + p[0]; /* touching p[0] is allowed: len was > cipher_list_len */ |
| p += 1 + p[0]; | |
| /* Parse extensions if present */ | |