From bcdb20158fefe3cccdac7449460a8cab650feded Mon Sep 17 00:00:00 2001
From: doug <>
Date: Tue, 14 Jul 2015 03:33:16 +0000
Subject: Convert ssl3_get_cert_status to CBS.
ok miod@ jsing@
---
src/lib/libssl/s3_clnt.c | 43 ++++++++++++++++++++++++----------------
src/lib/libssl/src/ssl/s3_clnt.c | 43 ++++++++++++++++++++++++----------------
2 files changed, 52 insertions(+), 34 deletions(-)
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index 1bbe2e686b..eed6cb5215 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_clnt.c,v 1.115 2015/07/14 03:27:20 doug Exp $ */
+/* $OpenBSD: s3_clnt.c,v 1.116 2015/07/14 03:33:16 doug Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@@ -1784,9 +1784,11 @@ err:
int
ssl3_get_cert_status(SSL *s)
{
+ CBS cert_status, response;
+ size_t stow_len;
int ok, al;
- unsigned long resplen, n;
- const unsigned char *p;
+ long n;
+ uint8_t status_type;
n = s->method->ssl_get_message(s, SSL3_ST_CR_CERT_STATUS_A,
SSL3_ST_CR_CERT_STATUS_B, SSL3_MT_CERTIFICATE_STATUS,
@@ -1794,36 +1796,43 @@ ssl3_get_cert_status(SSL *s)
if (!ok)
return ((int)n);
- if (n < 4) {
+
+ CBS_init(&cert_status, s->init_msg, n);
+
+ if (n < 0 || !CBS_get_u8(&cert_status, &status_type) ||
+ CBS_len(&cert_status) < 3) {
/* need at least status type + length */
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
SSL_R_LENGTH_MISMATCH);
goto f_err;
}
- p = (unsigned char *)s->init_msg;
- if (*p++ != TLSEXT_STATUSTYPE_ocsp) {
+
+ if (status_type != TLSEXT_STATUSTYPE_ocsp) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
SSL_R_UNSUPPORTED_STATUS_TYPE);
goto f_err;
}
- n2l3(p, resplen);
- if (resplen + 4 != n) {
+
+ if (!CBS_get_u24_length_prefixed(&cert_status, &response) ||
+ CBS_len(&cert_status) != 0) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
SSL_R_LENGTH_MISMATCH);
goto f_err;
}
- free(s->tlsext_ocsp_resp);
- if ((s->tlsext_ocsp_resp = malloc(resplen)) == NULL) {
- al = SSL_AD_INTERNAL_ERROR;
- SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
- ERR_R_MALLOC_FAILURE);
- goto f_err;
- }
- memcpy(s->tlsext_ocsp_resp, p, resplen);
- s->tlsext_ocsp_resplen = resplen;
+
+ if (!CBS_stow(&response, &s->tlsext_ocsp_resp,
+ &stow_len) || stow_len > INT_MAX) {
+ s->tlsext_ocsp_resplen = 0;
+ al = SSL_AD_INTERNAL_ERROR;
+ SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
+ ERR_R_MALLOC_FAILURE);
+ goto f_err;
+ }
+ s->tlsext_ocsp_resplen = (int)stow_len;
+
if (s->ctx->tlsext_status_cb) {
int ret;
ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index 1bbe2e686b..eed6cb5215 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_clnt.c,v 1.115 2015/07/14 03:27:20 doug Exp $ */
+/* $OpenBSD: s3_clnt.c,v 1.116 2015/07/14 03:33:16 doug Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
@@ -1784,9 +1784,11 @@ err:
int
ssl3_get_cert_status(SSL *s)
{
+ CBS cert_status, response;
+ size_t stow_len;
int ok, al;
- unsigned long resplen, n;
- const unsigned char *p;
+ long n;
+ uint8_t status_type;
n = s->method->ssl_get_message(s, SSL3_ST_CR_CERT_STATUS_A,
SSL3_ST_CR_CERT_STATUS_B, SSL3_MT_CERTIFICATE_STATUS,
@@ -1794,36 +1796,43 @@ ssl3_get_cert_status(SSL *s)
if (!ok)
return ((int)n);
- if (n < 4) {
+
+ CBS_init(&cert_status, s->init_msg, n);
+
+ if (n < 0 || !CBS_get_u8(&cert_status, &status_type) ||
+ CBS_len(&cert_status) < 3) {
/* need at least status type + length */
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
SSL_R_LENGTH_MISMATCH);
goto f_err;
}
- p = (unsigned char *)s->init_msg;
- if (*p++ != TLSEXT_STATUSTYPE_ocsp) {
+
+ if (status_type != TLSEXT_STATUSTYPE_ocsp) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
SSL_R_UNSUPPORTED_STATUS_TYPE);
goto f_err;
}
- n2l3(p, resplen);
- if (resplen + 4 != n) {
+
+ if (!CBS_get_u24_length_prefixed(&cert_status, &response) ||
+ CBS_len(&cert_status) != 0) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
SSL_R_LENGTH_MISMATCH);
goto f_err;
}
- free(s->tlsext_ocsp_resp);
- if ((s->tlsext_ocsp_resp = malloc(resplen)) == NULL) {
- al = SSL_AD_INTERNAL_ERROR;
- SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
- ERR_R_MALLOC_FAILURE);
- goto f_err;
- }
- memcpy(s->tlsext_ocsp_resp, p, resplen);
- s->tlsext_ocsp_resplen = resplen;
+
+ if (!CBS_stow(&response, &s->tlsext_ocsp_resp,
+ &stow_len) || stow_len > INT_MAX) {
+ s->tlsext_ocsp_resplen = 0;
+ al = SSL_AD_INTERNAL_ERROR;
+ SSLerr(SSL_F_SSL3_GET_CERT_STATUS,
+ ERR_R_MALLOC_FAILURE);
+ goto f_err;
+ }
+ s->tlsext_ocsp_resplen = (int)stow_len;
+
if (s->ctx->tlsext_status_cb) {
int ret;
ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
--
cgit v1.2.3-55-g6feb