From: Matt Caswell <matt@openssl.org>
Date: Thu, 11 May 2017 07:38:21 +0000 (+0100)
Subject: Ensure we fail with a decode error alert if the server sends and empty Cert
X-Git-Tag: OpenSSL_1_1_1-pre1~1538
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1a281aab730fc089291b774b05441c737f0d1d3d;p=openssl

Ensure we fail with a decode error alert if the server sends and empty Cert

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)
---

diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
index c1fec589ea..73dcff606e 100644
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -1688,7 +1688,8 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt)
     if ((SSL_IS_TLS13(s) && !PACKET_get_1(pkt, &context))
             || context != 0
             || !PACKET_get_net_3(pkt, &cert_list_len)
-            || PACKET_remaining(pkt) != cert_list_len) {
+            || PACKET_remaining(pkt) != cert_list_len
+            || PACKET_remaining(pkt) == 0) {
         al = SSL_AD_DECODE_ERROR;
         SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_LENGTH_MISMATCH);
         goto f_err;