Commit 27232cc3 authored by Matt Caswell's avatar Matt Caswell
Browse files

Don't use OPENSSL_strdup() for copying alpn_selected 



An alpn_selected value containing NUL bytes in it will result in
ext.alpn_selected_len having a larger value than the number of bytes
allocated in ext.alpn_selected.

Issue found by OSS-fuzz.

Reviewed-by: default avatarAndy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6507)
parent 4f1b96f9

ssl/ssl_asn1.c

+6 −4
Original line number Diff line number Diff line
@@ -328,7 +328,8 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, 


    ret->ext.tick_lifetime_hint = (unsigned long)as->tlsext_tick_lifetime_hint;

    ret->ext.tick_age_add = as->tlsext_tick_age_add;

    if (as->tlsext_tick) {

    OPENSSL_free(ret->ext.tick);

    if (as->tlsext_tick != NULL) {

        ret->ext.tick = as->tlsext_tick->data;

        ret->ext.ticklen = as->tlsext_tick->length;

        as->tlsext_tick->data = NULL;
@@ -355,11 +356,11 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, 
    ret->flags = (int32_t)as->flags;

    ret->ext.max_early_data = as->max_early_data;



    OPENSSL_free(ret->ext.alpn_selected);

    if (as->alpn_selected != NULL) {

        if (!ssl_session_strndup((char **)&ret->ext.alpn_selected,

                                 as->alpn_selected))

            goto err;

        ret->ext.alpn_selected = as->alpn_selected->data;

        ret->ext.alpn_selected_len = as->alpn_selected->length;

        as->alpn_selected->data = NULL;

    } else {

        ret->ext.alpn_selected = NULL;

        ret->ext.alpn_selected_len = 0;
@@ -367,6 +368,7 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, 


    ret->ext.max_fragment_len_mode = as->tlsext_max_fragment_len_mode;



    OPENSSL_free(ret->ticket_appdata);

    if (as->ticket_appdata != NULL) {

        ret->ticket_appdata = as->ticket_appdata->data;

        ret->ticket_appdata_len = as->ticket_appdata->length;

ssl/ssl_sess.c

+4 −6
Original line number Diff line number Diff line
@@ -220,14 +220,12 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket) 
        dest->ext.ticklen = 0;

    }



    if (src->ext.alpn_selected) {

        dest->ext.alpn_selected =

            (unsigned char*)OPENSSL_strndup((char*)src->ext.alpn_selected,

    if (src->ext.alpn_selected != NULL) {

        dest->ext.alpn_selected = OPENSSL_memdup(src->ext.alpn_selected,

                                                 src->ext.alpn_selected_len);

        if (dest->ext.alpn_selected == NULL) {

        if (dest->ext.alpn_selected == NULL)

            goto err;

    }

    }



#ifndef OPENSSL_NO_SRP

    if (src->srp_username) {