From 47439108a83a3142292d6cdb68f3f053aafc733c Mon Sep 17 00:00:00 2001 From: tb <> Date: Mon, 8 Jun 2026 12:05:25 +0000 Subject: tlsext: add XXX to consider refusing anything but uncompressed point format ok jsing kenjiro --- src/lib/libssl/ssl_tlsext.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src/lib/libssl') diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c index ccdb5d1dfa..22c5e7d1b1 100644 --- a/src/lib/libssl/ssl_tlsext.c +++ b/src/lib/libssl/ssl_tlsext.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.c,v 1.161 2026/06/06 08:45:41 tb Exp $ */ +/* $OpenBSD: ssl_tlsext.c,v 1.162 2026/06/08 12:05:25 tb Exp $ */ /* * Copyright (c) 2016, 2017, 2019 Joel Sing * Copyright (c) 2017 Doug Hogan @@ -386,6 +386,8 @@ tlsext_ecpf_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) if (CBS_len(&ecpf) == 0) return 0; + /* XXX - tighten this to reject anything but uncompressed format? */ + /* Must contain uncompressed (0) - RFC 8422, section 5.1.2. */ if (!CBS_contains_zero_byte(&ecpf)) { SSLerror(s, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); -- cgit v1.2.3-55-g6feb