]> git.ipfire.org Git - thirdparty/openssl.git/commit
Fix read out of buffer bounds when dealing with BIO_ADDR
authorAlexandr Nedvedicky <sashan@openssl.org>
Mon, 23 Dec 2024 16:03:32 +0000 (17:03 +0100)
committerTomas Mraz <tomas@openssl.org>
Tue, 25 Feb 2025 14:55:46 +0000 (15:55 +0100)
commit395a83a617a09c1ae02e8040386f9acb356d13c1
tree70ffb9c62e235d910ab2c9701e1f96ddc012c5df
parentececabd9adb4b4def9c044491f993b94ba0c618f
Fix read out of buffer bounds when dealing with BIO_ADDR

This issue was discoevered while I was testing SSL_new_from_listener()
using a newly created unit test. It has turned out the QUIC stack
at few places contain pattern as follows:
foo(QUIC_WHATEVER *q, BIO_ADDR *a)
{
   q->a = *a;
}

The problem is that derefencning a that way is risky. If the address `a`
comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR).
Using BIO_ADDR_copy() is the right thing to do here.

Fixes #26241

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26252)
crypto/bio/bio_addr.c
ssl/quic/quic_channel.c
ssl/quic/quic_record_tx.c
ssl/quic/quic_txp.c