From 7c3562947a50a5239c848fde2073e520b121ea0e Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 22 Nov 2012 14:15:25 +0000 Subject: [PATCH] reject zero length point format list or supported curves extensions --- ssl/t1_lib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 28eec44566..d8df062a80 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1077,7 +1077,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in int ellipticcurvelist_length = (*(sdata++) << 8); ellipticcurvelist_length += (*(sdata++)); - if (ellipticcurvelist_length != size - 2) + if (ellipticcurvelist_length != size - 2 || + ellipticcurvelist_length < 1) { *al = TLS1_AD_DECODE_ERROR; return 0; @@ -1433,7 +1434,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in unsigned char *sdata = data; int ecpointformatlist_length = *(sdata++); - if (ecpointformatlist_length != size - 1) + if (ecpointformatlist_length != size - 1 || + ecpointformatlist_length < 1) { *al = TLS1_AD_DECODE_ERROR; return 0; -- 2.40.0