BUG/MEDIUM: quic: error checking buffer large enought to receive the retry tag

Building a retry message, the offset of the tag was checked instead of the
remaining length into the buffer.

Must be backported as far as 2.6.

diff --git a/src/quic_conn.c b/src/quic_conn.c
index ed15f53ed58aafb1d5a7fe8443627e64ea013810..caf04a2446ca09fd6ede8118ce4c95ce7beb429e 100644 (file)
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -6677,7 +6677,7 @@ static int send_retry(int fd, struct sockaddr_storage *addr,
        i += token_len;
 
        /* token integrity tag */
-       if ((&buf[i] - buf < QUIC_TLS_TAG_LEN) ||
+       if ((sizeof(buf) - i < QUIC_TLS_TAG_LEN) ||
            !quic_tls_generate_retry_integrity_tag(pkt->dcid.data,
                                                   pkt->dcid.len, buf, i, qv)) {
                TRACE_ERROR("quic_tls_generate_retry_integrity_tag() failed", QUIC_EV_CONN_TXPKT);