Fix off-by-one buffer overflow in SSL_get_shared_ciphers().

From OpenSSL_0_9_8-stable branch.

ok djm@

2 files changed, 22 insertions, 22 deletions

diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index 4e8f302a5e..e9fda28f63 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1169,7 +1169,6 @@ int SSL_set_cipher_list(SSL *s,const char *str)
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
         {
         char *p;
-        const char *cp;
         STACK_OF(SSL_CIPHER) *sk;
         SSL_CIPHER *c;
         int i;
@@ -1182,20 +1181,21 @@ char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
         sk=s->session->ciphers;
         for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
                 {
-                /* Decrement for either the ':' or a '\0' */
-                len--;
+                int n;
+
                 c=sk_SSL_CIPHER_value(sk,i);
-                for (cp=c->name; *cp; )
+                n=strlen(c->name);
+                if (n+1 > len)
                         {
-                        if (len-- <= 0)
-                                {
-                                *p='\0';
-                                return(buf);
-                                }
-                        else
-                                *(p++)= *(cp++);
+                        if (p != buf)
+                                --p;
+                        *p='\0';
+                        return buf;
                         }
+                strcpy(p,c->name);
+                p+=n;
                 *(p++)=':';
+                len-=n+1;
                 }
         p[-1]='\0';
         return(buf);
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 4e8f302a5e..e9fda28f63 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1169,7 +1169,6 @@ int SSL_set_cipher_list(SSL *s,const char *str)
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
         {
         char *p;
-        const char *cp;
         STACK_OF(SSL_CIPHER) *sk;
         SSL_CIPHER *c;
         int i;
@@ -1182,20 +1181,21 @@ char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
         sk=s->session->ciphers;
         for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
                 {
-                /* Decrement for either the ':' or a '\0' */
-                len--;
+                int n;
+
                 c=sk_SSL_CIPHER_value(sk,i);
-                for (cp=c->name; *cp; )
+                n=strlen(c->name);
+                if (n+1 > len)
                         {
-                        if (len-- <= 0)
-                                {
-                                *p='\0';
-                                return(buf);
-                                }
-                        else
-                                *(p++)= *(cp++);
+                        if (p != buf)
+                                --p;
+                        *p='\0';
+                        return buf;
                         }
+                strcpy(p,c->name);
+                p+=n;
                 *(p++)=':';
+                len-=n+1;
                 }
         p[-1]='\0';
         return(buf);