session_pack: validate session_id_size on unpacking

A check for session_id_size not exceeding GNUTLS_MAX_SESSION_ID_SIZE
on loading persisted TLS session data was overlooked,
leading to a heap overflow
were the data corrupted in a malicious manner.

Reported-by: Haruto Kimura (Stella)
Fixes: #1817
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

diff --git a/lib/session_pack.c b/lib/session_pack.c
index e54917bd78fee05cd118722c3c1f913efa3cc2e7..4cd788e2155b83f70ceaea925a3f6eed20a593ea 100644 (file)
--- a/lib/session_pack.c
+++ b/lib/session_pack.c
@@ -973,6 +973,10 @@ static int unpack_security_parameters(gnutls_session_t session,
                &session->internals.resumed_security_parameters.session_id_size,
                1);
 
+       if (session->internals.resumed_security_parameters.session_id_size >
+           GNUTLS_MAX_SESSION_ID_SIZE)
+               return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+
        BUFFER_POP(
                ps, session->internals.resumed_security_parameters.session_id,
                session->internals.resumed_security_parameters.session_id_size);