added some extra checks in hello packet parsing.

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 9026eeb7405f57aeac83dc929584642623bd1f7f..a8add878bacfb34996d13010ac05f18bda4de716 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -518,6 +518,11 @@ gnutls_pk_algorithm algo=GNUTLS_PK_NONE, prev_algo = 0;
 gnutls_kx_algorithm kx;
 GNUTLS_CipherSuite cs;
 
+       if (datalen % 2 != 0) {
+               gnutls_assert();
+               return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+       }
+
        for (j = 0; j < datalen; j += 2) {
                memcpy( &cs.CipherSuite, &data[j], 2);
                kx = _gnutls_cipher_suite_get_kx_algo( &cs);
@@ -566,12 +571,20 @@ int _gnutls_server_select_suite(gnutls_session session, opaque *data, int datale
                else return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
        }
 
+       /* Data length should be zero mod 2 since
+        * every ciphersuite is 2 bytes. (this check is needed
+        * see below).
+        */
+       if (datalen % 2 == 0) {
+               gnutls_assert();
+               return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+       }
+
 #ifdef HANDSHAKE_DEBUG
 
        _gnutls_handshake_log("HSK[%x]: Requested cipher suites: \n", session);
        for (j = 0; j < datalen; j += 2) {
                memcpy( &cs.CipherSuite, &data[j], 2);
-
                _gnutls_handshake_log("\t%s\n",
                            _gnutls_cipher_suite_get_name(&cs));
        }

diff --git a/lib/gnutls_v2_compat.c b/lib/gnutls_v2_compat.c
index 25190d3441bbd1c1d4c1b3da3f6ce7dd7cd70490..7e603ff87da87febee2f377f11435c3044628565 100644 (file)
--- a/lib/gnutls_v2_compat.c
+++ b/lib/gnutls_v2_compat.c
@@ -46,6 +46,8 @@ static int _gnutls_handshake_select_v2_suite(gnutls_session session, opaque *dat
        int i, j, ret;
        opaque* _data;
        int _datalen;
+
+       _gnutls_handshake_log( "HSK[%x]: Parsing a version 2.0 client hello.\n", session);
        
        _data = gnutls_malloc( datalen);
        if (_data==NULL) {
@@ -53,7 +55,10 @@ static int _gnutls_handshake_select_v2_suite(gnutls_session session, opaque *dat
                return GNUTLS_E_MEMORY_ERROR;
        }
 
-       _gnutls_handshake_log( "HSK[%x]: Parsing a version 2.0 client hello.\n", session);
+       if (datalen % 3 != 0) {
+               gnutls_assert();
+               return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+       }
 
        i = _datalen = 0;
        for (j = 0; j < datalen; j += 3) {
@@ -182,7 +187,7 @@ int _gnutls_read_client_hello_v2(gnutls_session session, opaque * data,
        /* read random new values -skip session id for now */
        DECR_LEN(len, session_id_len); /* skip session id for now */
        memcpy( session_id, &data[pos], session_id_len);
-       pos+=session_id_len;
+       pos += session_id_len;
        
        DECR_LEN(len, challenge);
        memset( random, 0, TLS_RANDOM_SIZE);