Skip to content

Commit a8ad9f0

Browse files
committed
DoIgnore Missing Payload Bounds Validation
The DoIgnore() function was not bounds checking the ignore message. Changed it to use the GetSkip() function which does bounds checking and skips the current blob. Updated GetSkip() to allow 0 length blobs to skip. Affected function: DoIgnore. Issue: F-410
1 parent 801ac07 commit a8ad9f0

File tree

1 file changed

+3
-13
lines changed

1 file changed

+3
-13
lines changed

src/internal.c

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3575,12 +3575,12 @@ int GetSkip(const byte* buf, word32 len, word32* idx)
35753575
int result;
35763576
word32 sz;
35773577

3578-
result = GetUint32(&sz, buf, len, idx);
3578+
result = GetSize(&sz, buf, len, idx);
35793579

35803580
if (result == WS_SUCCESS) {
35813581
result = WS_BUFFER_E;
35823582

3583-
if (*idx < len && sz <= len - *idx) {
3583+
if (*idx <= len && sz <= len - *idx) {
35843584
*idx += sz;
35853585
result = WS_SUCCESS;
35863586
}
@@ -6320,18 +6320,8 @@ static int DoKexDhGexGroup(WOLFSSH* ssh,
63206320

63216321
static int DoIgnore(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
63226322
{
6323-
word32 dataSz;
6324-
word32 begin = *idx;
6325-
63266323
WOLFSSH_UNUSED(ssh);
6327-
WOLFSSH_UNUSED(len);
6328-
6329-
ato32(buf + begin, &dataSz);
6330-
begin += LENGTH_SZ + dataSz;
6331-
6332-
*idx = begin;
6333-
6334-
return WS_SUCCESS;
6324+
return GetSkip(buf, len, idx);
63356325
}
63366326

63376327
static int DoRequestSuccess(WOLFSSH *ssh, byte *buf, word32 len, word32 *idx)

0 commit comments

Comments
 (0)