From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Thu, 27 May 2004 21:11:41 +0000 (+0000)
Subject: added some extra checks in hello packet parsing.
X-Git-Tag: gnutls_1_1_11~59
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f1515ac8dfd090f06c2708a17141deec0b7fb6b3;p=thirdparty%2Fgnutls.git

added some extra checks in hello packet parsing.
---

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 9026eeb740..a8add878ba 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -518,6 +518,11 @@ gnutls_pk_algorithm algo=GNUTLS_PK_NONE, prev_algo = 0;
 gnutls_kx_algorithm kx;
 GNUTLS_CipherSuite cs;
 
+	if (datalen % 2 != 0) {
+		gnutls_assert();
+		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+	}
+
 	for (j = 0; j < datalen; j += 2) {
 		memcpy( &cs.CipherSuite, &data[j], 2);
 		kx = _gnutls_cipher_suite_get_kx_algo( &cs);
@@ -566,12 +571,20 @@ int _gnutls_server_select_suite(gnutls_session session, opaque *data, int datale
 		else return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
 	}
 
+	/* Data length should be zero mod 2 since
+	 * every ciphersuite is 2 bytes. (this check is needed
+	 * see below).
+	 */
+	if (datalen % 2 == 0) {
+		gnutls_assert();
+		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+	}
+
 #ifdef HANDSHAKE_DEBUG
 
 	_gnutls_handshake_log("HSK[%x]: Requested cipher suites: \n", session);
 	for (j = 0; j < datalen; j += 2) {
 		memcpy( &cs.CipherSuite, &data[j], 2);
-
 		_gnutls_handshake_log("\t%s\n",
 			    _gnutls_cipher_suite_get_name(&cs));
 	}
diff --git a/lib/gnutls_v2_compat.c b/lib/gnutls_v2_compat.c
index 25190d3441..7e603ff87d 100644
--- a/lib/gnutls_v2_compat.c
+++ b/lib/gnutls_v2_compat.c
@@ -46,6 +46,8 @@ static int _gnutls_handshake_select_v2_suite(gnutls_session session, opaque *dat
 	int i, j, ret;
 	opaque* _data;
 	int _datalen;
+
+	_gnutls_handshake_log( "HSK[%x]: Parsing a version 2.0 client hello.\n", session);
 	
 	_data = gnutls_malloc( datalen);
 	if (_data==NULL) {
@@ -53,7 +55,10 @@ static int _gnutls_handshake_select_v2_suite(gnutls_session session, opaque *dat
 		return GNUTLS_E_MEMORY_ERROR;
 	}
 
-	_gnutls_handshake_log( "HSK[%x]: Parsing a version 2.0 client hello.\n", session);
+	if (datalen % 3 != 0) {
+		gnutls_assert();
+		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+	}
 
 	i = _datalen = 0;
 	for (j = 0; j < datalen; j += 3) {
@@ -182,7 +187,7 @@ int _gnutls_read_client_hello_v2(gnutls_session session, opaque * data,
 	/* read random new values -skip session id for now */
 	DECR_LEN(len, session_id_len); /* skip session id for now */
 	memcpy( session_id, &data[pos], session_id_len);
-	pos+=session_id_len;
+	pos += session_id_len;
 	
 	DECR_LEN(len, challenge);
 	memset( random, 0, TLS_RANDOM_SIZE);