Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2025-12-21 21:36:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fixed possible heap overflow in pkcs1_decrypt on data larger than output

Browse source 
buffer after padding. For instance the premaster decryption in
   ssl_parse_client_key_exchange() in ssl_serv.c (Thanks to Christophe
   Devine)
This commit is contained in:
Paul Bakker 2009-01-12 21:48:39 +00:00
parent c32c6b56ca
commit 060c56871c
3 changed files with 15 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
library/ssl_srv.c
View file

@ -726,7 +726,8 @@ static int ssl_parse_client_key_exchange( ssl_context *ssl )
}
ret = rsa_pkcs1_decrypt( ssl->rsa_key, RSA_PRIVATE, &ssl->pmslen,
ssl->in_msg + i, ssl->premaster );
ssl->in_msg + i, ssl->premaster,
sizeof(ssl->premaster) );
if( ret != 0 || ssl->pmslen != 48 ||
ssl->premaster[0] != ssl->max_major_ver ||