From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Fri, 23 May 2014 17:50:31 +0000 (+0200)
Subject: Prevent memory corruption due to server hello parsing.
X-Git-Tag: gnutls_3_3_3~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=688ea6428a432c39203d00acd1af0e7684e5ddfd;p=thirdparty%2Fgnutls.git

Prevent memory corruption due to server hello parsing.

Issue discovered by Joonas Kuorilehto of Codenomicon.
---

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 3316ff158a..3765efd197 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -1751,7 +1751,7 @@ read_server_hello(gnutls_session_t session,
 	DECR_LEN(len, 1);
 	session_id_len = data[pos++];
 
-	if (len < session_id_len) {
+	if (len < session_id_len || session_id_len > TLS_MAX_SESSION_ID_SIZE) {
 		gnutls_assert();
 		return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
 	}