]> git.ipfire.org Git - thirdparty/openssl.git/commit
fix: add parsing check in TLS compress_certificate extension handler
authoryexiaochuan <tap91624@gmail.com>
Sat, 31 May 2025 09:47:58 +0000 (17:47 +0800)
committerTomas Mraz <tomas@openssl.org>
Tue, 10 Jun 2025 17:39:52 +0000 (19:39 +0200)
commit6e250f95731e2bdb0b07aa09071c34608db6dec9
tree9e84f70b198e785afb4676cd4cb95db6fd0e8dc2
parent4e2e155e183e55f8a8939f7e4ae8f6e12b0585f8
fix: add parsing check in TLS compress_certificate extension handler

The tls_parse_compress_certificate function was missing validation
for trailing bytes after parsing the algorithm list, violating
RFC8446 section 4.2 which requires sending a decode_error alert
for unparseable messages.

This commit adds a check for remaining bytes in the packet after
the while loop and sends SSL_AD_DECODE_ERROR if any trailing
bytes are found.

Fixes #27717

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27733)

(cherry picked from commit 8e787b102848e462a6d231883e2c42d91978c049)
ssl/statem/extensions.c