From 737df48ca584850ed0b5d4bb60494b65386a5d5f Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Sat, 6 Dec 2014 13:28:56 +0000
Subject: Ensure that the client specified EC curve list length is a multiple
 of two. The EC curve handling code assumes this to be the case and will read
 one byte off the end of the curve list during processing, in the case where
 it is not.

ok miod@
---
 src/lib/libssl/src/ssl/t1_lib.c | 5 +++--
 src/lib/libssl/t1_lib.c         | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

(limited to 'src')

diff --git a/src/lib/libssl/src/ssl/t1_lib.c b/src/lib/libssl/src/ssl/t1_lib.c
index 3412e70d30..5a6c0ddba0 100644
--- a/src/lib/libssl/src/ssl/t1_lib.c
+++ b/src/lib/libssl/src/ssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.69 2014/12/06 13:21:14 jsing Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.70 2014/12/06 13:28:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1370,7 +1370,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 			ellipticcurvelist_length += (*(sdata++));
 
 			if (ellipticcurvelist_length != size - 2 ||
-			    ellipticcurvelist_length < 1) {
+			    ellipticcurvelist_length < 1 ||
+			    ellipticcurvelist_length % 2 != 0) {
 				*al = TLS1_AD_DECODE_ERROR;
 				return 0;
 			}
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 3412e70d30..5a6c0ddba0 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.69 2014/12/06 13:21:14 jsing Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.70 2014/12/06 13:28:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1370,7 +1370,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 			ellipticcurvelist_length += (*(sdata++));
 
 			if (ellipticcurvelist_length != size - 2 ||
-			    ellipticcurvelist_length < 1) {
+			    ellipticcurvelist_length < 1 ||
+			    ellipticcurvelist_length % 2 != 0) {
 				*al = TLS1_AD_DECODE_ERROR;
 				return 0;
 			}
-- 
cgit v1.2.3-55-g6feb