From 8de29499ce67d4b8cd77a4ab477f0081cc863ea6 Mon Sep 17 00:00:00 2001 From: Ivan Grokhotkov Date: Thu, 19 Apr 2018 11:51:27 +0800 Subject: [PATCH] mbedtls: Add bounds check before length read This is part of the patch for CVE-2018-9989. Cherry-picked from https://github.com/ARMmbed/mbedtls/commit/740b218386083dc708ce98ccc94a63a95cd5629e Ref. https://github.com/espressif/esp-idf/issues/1860 --- components/mbedtls/library/ssl_cli.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/components/mbedtls/library/ssl_cli.c b/components/mbedtls/library/ssl_cli.c index f9109a755..99f492819 100644 --- a/components/mbedtls/library/ssl_cli.c +++ b/components/mbedtls/library/ssl_cli.c @@ -2049,6 +2049,12 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl, * * opaque psk_identity_hint<0..2^16-1>; */ + if( (*p) > end - 2 ) + { + MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message " + "(psk_identity_hint length)" ) ); + return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); + } len = (*p)[0] << 8 | (*p)[1]; *p += 2;