Check key_exchange data length is not 0

Reviewed-by: N Rich Salz <rsalz@openssl.org>

Check key_exchange data length is not 0
Reviewed-by: N Rich Salz <rsalz@openssl.org>
323f212a · Matt Caswell · 2ee1271d · 323f212a
显示空白变更内容
内联并排

Showing with 2 addition and 1 deletion

ssl/t1_lib.c ssl/t1_lib.c +2 -1

未找到文件。
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2754,7 +2754,8 @@ static int ssl_scan_serverhello_tlsext(SSL *s, PACKET *pkt, int *al)
            skey = ssl_generate_pkey(ckey);
-            if (!PACKET_as_length_prefixed_2(&spkt, &encoded_pt)) {
+            if (!PACKET_as_length_prefixed_2(&spkt, &encoded_pt)
+                    || PACKET_remaining(&encoded_pt) == 0) {
                *al = SSL_AD_DECODE_ERROR;
                SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
                       SSL_R_LENGTH_MISMATCH);