diff options
| author | Miod Vallat <miod@cvs.openbsd.org> | 2014-05-18 16:10:27 +0000 |
|---|---|---|
| committer | Miod Vallat <miod@cvs.openbsd.org> | 2014-05-18 16:10:27 +0000 |
| commit | a71ebc8d6d8ed6ccde26b10d0d6b33d52abbd888 (patch) | |
| tree | eb9bdbe61c6745f9d06a6edb46a99d974dacf200 /lib | |
| parent | c803d3fbc581831b8d458586a39909b1d8428b5d (diff) | |
In ssl3_send_certificate_request(), when adding the extra payload if
NETSCAPE_HANG_BUG is defined, make sure we BUF_MEM_grow() the buffer to
accomodate for the payload size.
Issue reported by David Ramos; ok beck@
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libssl/s3_srvr.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/lib/libssl/s3_srvr.c b/lib/libssl/s3_srvr.c index 081aebf1f5d..decf35d50fe 100644 --- a/lib/libssl/s3_srvr.c +++ b/lib/libssl/s3_srvr.c @@ -1988,7 +1988,12 @@ ssl3_send_certificate_request(SSL *s) s->init_num = n + 4; s->init_off = 0; #ifdef NETSCAPE_HANG_BUG - p = (unsigned char *)s->init_buf->data + s->init_num; + if (!BUF_MEM_grow(buf, s->init_num + 4)) { + SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST, + ERR_R_BUF_LIB); + goto err; + } + p = (unsigned char *)buf->data + s->init_num; /* do the header */ *(p++) = SSL3_MT_SERVER_DONE; |