out-of-bounds read in (unused) kerberos ciphersuites (CAN-2004-0112)

2 files changed, 32 insertions, 0 deletions

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 57f1d3f52a..deb3cffabe 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1588,11 +1588,27 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                 n2s(p,i);
                 enc_ticket.length = i;
+
+                if (n < enc_ticket.length + 6)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                SSL_R_DATA_LENGTH_TOO_LONG);
+                        goto err;
+                        }
+
                 enc_ticket.data = (char *)p;
                 p+=enc_ticket.length;
 
                 n2s(p,i);
                 authenticator.length = i;
+
+                if (n < enc_ticket.length + authenticator.length + 6)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                SSL_R_DATA_LENGTH_TOO_LONG);
+                        goto err;
+                        }
+
                 authenticator.data = (char *)p;
                 p+=authenticator.length;
 
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 57f1d3f52a..deb3cffabe 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1588,11 +1588,27 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                 n2s(p,i);
                 enc_ticket.length = i;
+
+                if (n < enc_ticket.length + 6)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                SSL_R_DATA_LENGTH_TOO_LONG);
+                        goto err;
+                        }
+
                 enc_ticket.data = (char *)p;
                 p+=enc_ticket.length;
 
                 n2s(p,i);
                 authenticator.length = i;
+
+                if (n < enc_ticket.length + authenticator.length + 6)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                SSL_R_DATA_LENGTH_TOO_LONG);
+                        goto err;
+                        }
+
                 authenticator.data = (char *)p;
                 p+=authenticator.length;