Commit 532ee6e0 authored by Miod Vallat's avatar Miod Vallat Committed by Matt Caswell
Browse files

Fix off-by-one errors in ssl_cipher_get_evp() 

In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

Bug discovered and fixed by Miod Vallat from the OpenBSD team.

PR#3375
parent 08db2cc9

ssl/ssl_ciph.c

+2 −2
Original line number Diff line number Diff line
@@ -531,7 +531,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, 
		break;

		}



	if ((i < 0) || (i > SSL_ENC_NUM_IDX))

	if ((i < 0) || (i >= SSL_ENC_NUM_IDX))

		*enc=NULL;

	else

		{
@@ -559,7 +559,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, 
		i= -1;

		break;

		}

	if ((i < 0) || (i > SSL_MD_NUM_IDX))

	if ((i < 0) || (i >= SSL_MD_NUM_IDX))

	{

		*md=NULL; 

		if (mac_pkey_type!=NULL) *mac_pkey_type = NID_undef;