aboutsummaryrefslogtreecommitdiffstats
path: root/ssl/s2_pkt.c
diff options
context:
space:
mode:
Diffstat (limited to 'ssl/s2_pkt.c')
-rw-r--r--ssl/s2_pkt.c14
1 files changed, 14 insertions, 0 deletions
diff --git a/ssl/s2_pkt.c b/ssl/s2_pkt.c
index 614b9a35d2ea..7a6188813431 100644
--- a/ssl/s2_pkt.c
+++ b/ssl/s2_pkt.c
@@ -576,6 +576,20 @@ static int n_do_ssl_write(SSL *s, const unsigned char *buf, unsigned int len)
s->s2->padding = p;
s->s2->mac_data = &(s->s2->wbuf[3]);
s->s2->wact_data = &(s->s2->wbuf[3 + mac_size]);
+
+ /*
+ * It would be clearer to write this as follows:
+ * if (mac_size + len + p > SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER)
+ * However |len| is user input that could in theory be very large. We
+ * know |mac_size| and |p| are small, so to avoid any possibility of
+ * overflow we write it like this.
+ *
+ * In theory this should never fail because the logic above should have
+ * modified |len| if it is too big. But we are being cautious.
+ */
+ if (len > (SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER - (mac_size + p))) {
+ return -1;
+ }
/* we copy the data into s->s2->wbuf */
memcpy(s->s2->wact_data, buf, len);
if (p)