From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Tue, 4 Dec 2012 19:57:38 +0000 (+0100)
Subject: Corrected bugs in record parsing.
X-Git-Tag: gnutls_3_1_6~44
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eb2f4e7ca984c5ef765851388f829ef9e7ec5c9b;p=thirdparty%2Fgnutls.git

Corrected bugs in record parsing.

Corrected bugs in record padding parsing. Reported by Kenny Patterson and Nadhem Alfardan.
---

diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index 248b376a54..a9a02de317 100644
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -441,10 +441,10 @@ ciphertext_to_compressed (gnutls_session_t session,
                           uint64* sequence)
 {
   uint8_t tag[MAX_HASH_SIZE];
-  uint8_t pad;
+  unsigned int pad, i;
   int length, length_to_decrypt;
   uint16_t blocksize;
-  int ret, i, pad_failed = 0;
+  int ret, pad_failed = 0;
   uint8_t preamble[MAX_PREAMBLE_SIZE];
   unsigned int preamble_size;
   unsigned int ver = gnutls_protocol_get_version (session);
@@ -541,7 +541,7 @@ ciphertext_to_compressed (gnutls_session_t session,
       pad = ciphertext->data[ciphertext->size - 1] + 1;   /* pad */
 
 
-      if ((int) pad > (int) ciphertext->size - tag_size)
+      if (pad > (int) ciphertext->size - tag_size)
         {
           gnutls_assert ();
           _gnutls_record_log
@@ -559,7 +559,7 @@ ciphertext_to_compressed (gnutls_session_t session,
       /* Check the pading bytes (TLS 1.x)
        */
       if (ver != GNUTLS_SSL3)
-        for (i = 2; i < pad; i++)
+        for (i = 2; i <= pad; i++)
           {
             if (ciphertext->data[ciphertext->size - i] !=
                 ciphertext->data[ciphertext->size - 1])