Unified · Split
| @@ -500,9 +500,7 @@ tlsClientExtensions(TLSconn *conn, int *plen) · 499 unmodified lines | ||
| 500 | 500 | p = b = nil; |
| 501 | 501 | |
| 502 | 502 | // RFC6066 - Server Name Identification |
| 503 | − if(conn->serverName != nil){ | |
| 504 | − n = strlen(conn->serverName); | |
| 505 | − | |
| 503 | + if(conn->serverName != nil && (n = strlen(conn->serverName)) > 0){ | |
| 506 | 504 | m = p - b; |
| 507 | 505 | b = erealloc(b, m + 2+2+2+1+2+n); |
| 508 | 506 | p = b + m; |
| @@ -655,37 +653,26 @@ checkClientExtensions(TlsConnection *c, Bytes *ext) · 146 unmodified lines | ||
| 655 | 653 | uchar *p, *e; |
| 656 | 654 | int i, j, n; |
| 657 | 655 | |
| 658 | − p = ext->data; | |
| 659 | − e = p+ext->len; | |
| 660 | − while(p < e){ | |
| 661 | − if(e-p < 2) | |
| 656 | + if(ext == nil) | |
| 657 | + return 0; | |
| 658 | + | |
| 659 | + for(p = ext->data, e = p+ext->len; p < e; p += n){ | |
| 660 | + if(e-p < 4) | |
| 662 | 661 | goto Short; |
| 663 | − switch(get16(p)){ | |
| 664 | − case Extec: | |
| 665 | − p += 2; | |
| 666 | − n = get16(p); | |
| 667 | − if(e-p < n || n < 2) | |
| 662 | + p += 4; | |
| 663 | + if(e-p < (n = get16(p-2))) | |
| 664 | + goto Short; | |
| 665 | + switch(get16(p-4)){ | |
| 666 | + case Extec: | |
| 667 | + if(n < 4 || n % 2 || get16(p) != (n -= 2)) | |
| 668 | 668 | goto Short; |
| 669 | 669 | p += 2; |
| 670 | − n = get16(p); | |
| 671 | − p += 2; | |
| 672 | − if(e-p < n || n & 1 || n == 0) | |
| 673 | − goto Short; | |
| 674 | 670 | for(i = 0; i < nelem(namedcurves) && c->sec->nc == nil; i++) |
| 675 | 671 | for(j = 0; j < n; j += 2) |
| 676 | 672 | if(namedcurves[i].tlsid == get16(p+j)){ |
| 677 | 673 | c->sec->nc = &namedcurves[i]; |
| 678 | 674 | break; |
| 679 | 675 | } |
| 680 | − p += n; | |
| 681 | − break; | |
| 682 | − default: | |
| 683 | − p += 2; | |
| 684 | − n = get16(p); | |
| 685 | − p += 2; | |
| 686 | − if(e-p < n) | |
| 687 | − goto Short; | |
| 688 | − p += n; | |
| 689 | 676 | break; |
| 690 | 677 | } |
| 691 | 678 | } |
| @@ -1591,7 +1578,7 @@ msgRecv(TlsConnection *c, Msg *m) · 899 unmodified lines | ||
| 1591 | 1578 | nn = get16(p); |
| 1592 | 1579 | p += 2, n -= 2; |
| 1593 | 1580 | |
| 1594 | − if((nn & 1) || n < nn || nn < 2) | |
| 1581 | + if(nn % 2 || n < nn || nn < 2) | |
| 1595 | 1582 | goto Short; |
| 1596 | 1583 | m->u.clientHello.ciphers = newints(nn >> 1); |
| 1597 | 1584 | for(i = 0; i < nn; i += 2) |
| @@ -1680,7 +1667,7 @@ msgRecv(TlsConnection *c, Msg *m) · 82 unmodified lines | ||
| 1680 | 1667 | goto Short; |
| 1681 | 1668 | nn = get16(p); |
| 1682 | 1669 | p += 2, n -= 2; |
| 1683 | − if(nn & 1) | |
| 1670 | + if(nn % 2) | |
| 1684 | 1671 | goto Short; |
| 1685 | 1672 | m->u.certificateRequest.sigalgs = newints(nn>>1); |
| 1686 | 1673 | for(i = 0; i < nn; i += 2) |