diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2022-01-12 20:24:57 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-01-12 20:24:57 +0100 |
| commit | b080a1c136fadb675c42bb72309e7c479ac7d292 (patch) | |
| tree | 1ed4dda627b17646643ea8ab6b428e4d63b114dd /src/lib/protocols/tls.c | |
| parent | 552d199d2eb8a9cd42aa9aa84057eaa6f3c57fb4 (diff) | |
Fix two use-of-uninitialized-value errors (#1398)
Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40269
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41432
Fix fuzz compilation (follow-up of f5545a80)
Diffstat (limited to 'src/lib/protocols/tls.c')
| -rw-r--r-- | src/lib/protocols/tls.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index 622fa678f..4815275d4 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -1718,6 +1718,14 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, checkExtensions(ndpi_struct, flow, is_dtls, extension_id, extension_len, offset + extension_offset); + if(offset + 4 + extension_len > total_len) { +#ifdef DEBUG_TLS + printf("[TLS] extension length %u too long (%u, offset %u)\n", + extension_len, total_len, offset); +#endif + break; + } + if((extension_id == 0) || (packet->payload[extn_off] != packet->payload[extn_off+1])) { /* Skip GREASE */ @@ -1957,7 +1965,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, printf("[SIGNATURE] [is_firefox_tls: %u][is_chrome_tls: %u][is_safari_tls: %u][duplicate_found: %u]\n", flow->protos.tls_quic.browser_heuristics.is_firefox_tls, flow->protos.tls_quic.browser_heuristics.is_chrome_tls, - flow->protos..tls_quic.browser_heuristics.is_safari_tls, + flow->protos.tls_quic.browser_heuristics.is_safari_tls, duplicate_found); #endif |