|
| 1 | +From c98e21a34e93c5d76cfafd4e42af2e076b8122e7 Mon Sep 17 00:00:00 2001 |
| 2 | +From: AllSpark <allspark@microsoft.com> |
| 3 | +Date: Mon, 25 May 2026 08:44:24 +0000 |
| 4 | +Subject: [PATCH] lib/buffers: ensure packets with duplicate sequence but |
| 5 | + mismatched type are discarded; fix comparator to return 0 when sequence equal |
| 6 | + for stable sort (backport) |
| 7 | + |
| 8 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 9 | +Upstream-reference: AI Backport of https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d.patch https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f.patch |
| 10 | + |
| 11 | +--- |
| 12 | + lib/buffers.c | 25 ++++++++++++++++++------- |
| 13 | + 1 file changed, 18 insertions(+), 7 deletions(-) |
| 14 | + |
| 15 | +diff --git a/lib/buffers.c b/lib/buffers.c |
| 16 | +index f419193..e41ecde 100644 |
| 17 | +--- a/lib/buffers.c |
| 18 | ++++ b/lib/buffers.c |
| 19 | +@@ -844,11 +844,7 @@ static int handshake_compare(const void *_e1, const void *_e2) |
| 20 | + { |
| 21 | + const handshake_buffer_st *e1 = _e1; |
| 22 | + const handshake_buffer_st *e2 = _e2; |
| 23 | +- |
| 24 | +- if (e1->sequence <= e2->sequence) |
| 25 | +- return 1; |
| 26 | +- else |
| 27 | +- return -1; |
| 28 | ++ return (e1->sequence < e2->sequence) - (e1->sequence > e2->sequence); |
| 29 | + } |
| 30 | + |
| 31 | + #define SSL2_HEADERS 1 |
| 32 | +@@ -966,9 +962,24 @@ static int merge_handshake_packet(gnutls_session_t session, |
| 33 | + int exists = 0, i, pos = 0; |
| 34 | + int ret; |
| 35 | + |
| 36 | ++ handshake_buffer_st *recv_buf = |
| 37 | ++ session->internals.handshake_recv_buffer; |
| 38 | ++ |
| 39 | + for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) { |
| 40 | +- if (session->internals.handshake_recv_buffer[i].htype == |
| 41 | +- hsk->htype) { |
| 42 | ++ if (recv_buf[i].sequence == hsk->sequence) { |
| 43 | ++ if (recv_buf[i].htype != hsk->htype) { |
| 44 | ++ _gnutls_audit_log( |
| 45 | ++ session, |
| 46 | ++ "Discarded unexpected handshake packet " |
| 47 | ++ "with duplicate sequence %d, but " |
| 48 | ++ "mismatched type %s (previously %s)\n", |
| 49 | ++ hsk->sequence, |
| 50 | ++ _gnutls_handshake2str(hsk->htype), |
| 51 | ++ _gnutls_handshake2str( |
| 52 | ++ recv_buf[i].htype)); |
| 53 | ++ _gnutls_handshake_buffer_clear(hsk); |
| 54 | ++ return 0; |
| 55 | ++ } |
| 56 | + exists = 1; |
| 57 | + pos = i; |
| 58 | + break; |
| 59 | +-- |
| 60 | +2.45.4 |
| 61 | + |
0 commit comments