Add a return value check to tls13_buffer_extend().

In the unlikely event that the return value from the read callback is
larger than the number of bytes we asked for, we can end up incrementing
buf->len beyond capacity. Check the return value from the read callback to
prevent this.

ok inoguchi@ tb@

1 files changed, 4 insertions, 1 deletions

diff --git a/src/lib/libssl/tls13_buffer.c b/src/lib/libssl/tls13_buffer.c
index 8990327bb6..bc10abded2 100644
--- a/src/lib/libssl/tls13_buffer.c
+++ b/src/lib/libssl/tls13_buffer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_buffer.c,v 1.2 2019/11/20 16:21:20 beck Exp $ */
+/* $OpenBSD: tls13_buffer.c,v 1.3 2020/03/10 17:11:25 jsing Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -104,6 +104,9 @@ tls13_buffer_extend(struct tls13_buffer *buf, size_t len,
                     buf->capacity - buf->len, cb_arg)) <= 0)
                         return ret;
 
+                if (ret > buf->capacity - buf->len)
+                        return TLS13_IO_FAILURE;
+
                 buf->len += ret;
 
                 if (buf->len == buf->capacity)