From fc8ff75814767d6c55ea78d05adc72cd346d0f0a Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 31 May 2024 11:22:13 +0100 Subject: [PATCH] Use correctly formatted ALPN data in tserver The QUIC test server was using incorrectly formatted ALPN data. With the previous implementation of SSL_select_next_proto this went unnoticed. With the new stricter implemenation it was failing. Follow on from CVE-2024-5535 Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/24716) --- ssl/quic/quic_tserver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/quic/quic_tserver.c b/ssl/quic/quic_tserver.c index b9de60aea15..4f30eb14cec 100644 --- a/ssl/quic/quic_tserver.c +++ b/ssl/quic/quic_tserver.c @@ -63,7 +63,7 @@ static int alpn_select_cb(SSL *ssl, const unsigned char **out, if (srv->args.alpn == NULL) { alpn = alpndeflt; - alpnlen = sizeof(alpn); + alpnlen = sizeof(alpndeflt); } else { alpn = srv->args.alpn; alpnlen = srv->args.alpnlen; -- 2.47.2