From c6489249a3c1cf02630823f8d56d7b0e1c77d25e Mon Sep 17 00:00:00 2001
From: tb <>
Date: Sat, 9 May 2026 14:16:37 +0000
Subject: openssl s_client: avoid two out of bounds writes

A NUL termination after an unchecked BIO_read() call in XMSS mode could
lead to a write one byte before the start of sbuf or one past its end.
Add an error check to avoid the former and read one byte less to avoid the
latter.

Found by Frank Denis
---
 src/usr.bin/openssl/s_client.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/usr.bin/openssl/s_client.c b/src/usr.bin/openssl/s_client.c
index 2b05facc17..00b6f7178a 100644
--- a/src/usr.bin/openssl/s_client.c
+++ b/src/usr.bin/openssl/s_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_client.c,v 1.68 2026/02/01 08:45:31 martijn Exp $ */
+/* $OpenBSD: s_client.c,v 1.69 2026/05/09 14:16:37 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1314,7 +1314,9 @@ s_client_main(int argc, char **argv)
 		}
 		BIO_printf(sbio,
 		    "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
-		seen = BIO_read(sbio, sbuf, BUFSIZZ);
+		seen = BIO_read(sbio, sbuf, BUFSIZZ - 1);
+		if (seen <= 0)
+			goto shut;
 		sbuf[seen] = 0;
 		if (!strstr(sbuf, "<proceed"))
 			goto shut;
-- 
cgit v1.2.3-55-g6feb