tls: Check for minimal TLS record length before each record iteration

Fixes fragment reassembling if a buffer contains more than one record, but
the last record contains a partial TLS record header. Thanks to Nick Saunders
and Jamil Nimeh for identifying this issue and providing a fix for it.

diff --git a/src/libtls/tls.c b/src/libtls/tls.c
index 6b51e759384b15bd62d294f535b1d44dd02ed8b6..7314602b664f89e0738a02820a82d56ad36c5771 100644 (file)
--- a/src/libtls/tls.c
+++ b/src/libtls/tls.c
@@ -218,14 +218,7 @@ METHOD(tls_t, process, status_t,
        {
                if (this->input.len == 0)
                {
-                       if (buflen < sizeof(tls_record_t))
-                       {
-                               DBG2(DBG_TLS, "received incomplete TLS record header");
-                               memcpy(&this->head, buf, buflen);
-                               this->headpos = buflen;
-                               break;
-                       }
-                       while (TRUE)
+                       while (buflen >= sizeof(tls_record_t))
                        {
                                /* try to process records inline */
                                record = buf;
@@ -252,6 +245,13 @@ METHOD(tls_t, process, status_t,
                                        return NEED_MORE;
                                }
                        }
+                       if (buflen < sizeof(tls_record_t))
+                       {
+                               DBG2(DBG_TLS, "received incomplete TLS record header");
+                               memcpy(&this->head, buf, buflen);
+                               this->headpos = buflen;
+                               break;
+                       }
                }
                len = min(buflen, this->input.len - this->inpos);
                memcpy(this->input.ptr + this->inpos, buf, len);