Commit 8f12296e authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Disallow zero length signature algorithms 



Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2840)
parent 224b4e37

ssl/statem/statem_srvr.c

+1 −0
Original line number Diff line number Diff line
@@ -2497,6 +2497,7 @@ int tls_construct_certificate_request(SSL *s, WPACKET *pkt) 
        size_t nl = tls12_get_psigalgs(s, 1, &psigs);



        if (!WPACKET_start_sub_packet_u16(pkt)

                || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)

                || !tls12_copy_sigalgs(s, pkt, psigs, nl)

                || !WPACKET_close(pkt)) {

            SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,

ssl/t1_lib.c

+1 −1
Original line number Diff line number Diff line
@@ -1563,7 +1563,7 @@ int tls1_save_sigalgs(SSL *s, PACKET *pkt) 
    size = PACKET_remaining(pkt);



    /* Invalid data length */

    if ((size & 1) != 0)

    if (size == 0 || (size & 1) != 0)

        return 0;



    size >>= 1;