]> git.ipfire.org Git - thirdparty/openssl.git/commit
fix: add parsing check in TLS compress_certificate extension handler
authoryexiaochuan <tap91624@gmail.com>
Sat, 31 May 2025 09:47:58 +0000 (17:47 +0800)
committerTomas Mraz <tomas@openssl.org>
Tue, 10 Jun 2025 17:39:29 +0000 (19:39 +0200)
commit8e787b102848e462a6d231883e2c42d91978c049
tree6a8e6160419e8687aec59c4c444e05a7df696930
parentc37b9e3425c8576d089342c7cfdcc4dc0aedde54
fix: add parsing check in TLS compress_certificate extension handler

The tls_parse_compress_certificate function was missing validation
for trailing bytes after parsing the algorithm list, violating
RFC8446 section 4.2 which requires sending a decode_error alert
for unparseable messages.

This commit adds a check for remaining bytes in the packet after
the while loop and sends SSL_AD_DECODE_ERROR if any trailing
bytes are found.

Fixes #27717

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27733)
ssl/statem/extensions.c