diff options
| author | Michael Baentsch <57787676+baentsch@users.noreply.github.com> | 2024-02-19 06:41:35 +0100 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-02-22 12:48:21 +0100 |
| commit | f4ed6eed2c8fcb1852938683669218655fe4f894 (patch) | |
| tree | 36d38c2936c37723d3c5b9a5bcadb49564661d47 /test/tls-provider.c | |
| parent | s_cb.c: Add missing return value checks (diff) | |
| download | openssl-f4ed6eed2c8fcb1852938683669218655fe4f894.tar.xz openssl-f4ed6eed2c8fcb1852938683669218655fe4f894.zip | |
SSL_set1_groups_list(): Fix memory corruption with 40 groups and more
Fixes #23624
The calculation of the size for gid_arr reallocation was wrong.
A multiplication by gid_arr array item size was missing.
Testcase is added.
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23625)
Diffstat (limited to 'test/tls-provider.c')
| -rw-r--r-- | test/tls-provider.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/test/tls-provider.c b/test/tls-provider.c index 5f1479435f..e5737dc5df 100644 --- a/test/tls-provider.c +++ b/test/tls-provider.c @@ -410,6 +410,8 @@ static int tls_prov_get_capabilities(void *provctx, const char *capability, } dummygroup[0].data = dummy_group_names[i]; dummygroup[0].data_size = strlen(dummy_group_names[i]) + 1; + /* assign unique group IDs also to dummy groups for registration */ + *((int *)(dummygroup[3].data)) = 65279 - NUM_DUMMY_GROUPS + i; ret &= cb(dummygroup, arg); } } @@ -3185,9 +3187,10 @@ unsigned int randomize_tls_alg_id(OSSL_LIB_CTX *libctx) return 0; /* * Ensure id is within the IANA Reserved for private use range - * (65024-65279) + * (65024-65279). + * Carve out NUM_DUMMY_GROUPS ids for properly registering those. */ - id %= 65279 - 65024; + id %= 65279 - NUM_DUMMY_GROUPS - 65024; id += 65024; /* Ensure we did not already issue this id */ |