Skip to content
Commit acacbfa7 authored by Matt Caswell's avatar Matt Caswell
Browse files

Fix Use After Free for large message sizes

The buffer to receive messages is initialised to 16k. If a message is
received that is larger than that then the buffer is "realloc'd". This can
cause the location of the underlying buffer to change. Anything that is
referring to the old location will be referring to free'd data. In the
recent commit c1ef7c97 (master) and 4b390b6c

 (1.1.0) the point in the code
where the message buffer is grown was changed. However s->init_msg was not
updated to point at the new location.

CVE-2016-6309

Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>
(cherry picked from commit 0d698f66)
parent df7681e4
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment