From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Wed, 30 Sep 2020 12:29:37 +0000 (+0200)
Subject: nts: handle invalid algorithm in TLS key export
X-Git-Tag: 4.0~19
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a655eab34f664404224104783460640f6cca3ad8;p=thirdparty%2Fchrony.git

nts: handle invalid algorithm in TLS key export
---

diff --git a/nts_ke_session.c b/nts_ke_session.c
index d18e89df..ac27f84d 100644
--- a/nts_ke_session.c
+++ b/nts_ke_session.c
@@ -825,21 +825,27 @@ NKSN_GetRecord(NKSN_Instance inst, int *critical, int *type, int *body_length,
 int
 NKSN_GetKeys(NKSN_Instance inst, SIV_Algorithm siv, NKE_Key *c2s, NKE_Key *s2c)
 {
-  c2s->length = SIV_GetKeyLength(siv);
-  s2c->length = SIV_GetKeyLength(siv);
-  assert(c2s->length <= sizeof (c2s->key));
-  assert(s2c->length <= sizeof (s2c->key));
+  int length = SIV_GetKeyLength(siv);
+
+  if (length <= 0 || length > sizeof (c2s->key) || length > sizeof (s2c->key)) {
+    DEBUG_LOG("Invalid algorithm");
+    return 0;
+  }
 
   if (gnutls_prf_rfc5705(inst->tls_session,
                          sizeof (NKE_EXPORTER_LABEL) - 1, NKE_EXPORTER_LABEL,
                          sizeof (NKE_EXPORTER_CONTEXT_C2S) - 1, NKE_EXPORTER_CONTEXT_C2S,
-                         c2s->length, (char *)c2s->key) < 0)
-    return 0;
-  if (gnutls_prf_rfc5705(inst->tls_session,
+                         length, (char *)c2s->key) < 0 ||
+      gnutls_prf_rfc5705(inst->tls_session,
                          sizeof (NKE_EXPORTER_LABEL) - 1, NKE_EXPORTER_LABEL,
                          sizeof (NKE_EXPORTER_CONTEXT_S2C) - 1, NKE_EXPORTER_CONTEXT_S2C,
-                         s2c->length, (char *)s2c->key) < 0)
+                         length, (char *)s2c->key) < 0) {
+    DEBUG_LOG("Could not export key");
     return 0;
+  }
+
+  c2s->length = length;
+  s2c->length = length;
 
   return 1;
 }