From 206ce0a317c63c61655b4b2dbce94b1dcdb8f965 Mon Sep 17 00:00:00 2001 From: emanuele-f Date: Fri, 4 Oct 2019 14:35:31 +0200 Subject: Fix invalid memory accesses --- src/lib/protocols/tls.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'src/lib/protocols/tls.c') diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index f621c2be3..cb4f7ac05 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -786,7 +786,12 @@ int getSSCertificateFingerprint(struct ndpi_detection_module_struct *ndpi_struct #endif return(1); /* More packets please */ } - } + } + + if(packet->payload_packet_len <= flow->l4.tcp.tls_record_offset) { + /* Avoid invalid memory accesses */ + return(1); + } if(packet->payload[flow->l4.tcp.tls_record_offset] == 0x15 /* Alert */) { u_int len = ntohs(*(u_int16_t*)&packet->payload[flow->l4.tcp.tls_record_offset+3]) + 5 /* SSL header len */; @@ -833,7 +838,7 @@ int getSSCertificateFingerprint(struct ndpi_detection_module_struct *ndpi_struct return(0); /* That's all */ } else if(flow->l4.tcp.tls_seen_certificate) return(0); /* That's all */ - else { + else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7) { /* This is a handshake but not a certificate record */ u_int16_t len = ntohs(*(u_int16_t*)&packet->payload[flow->l4.tcp.tls_record_offset+7]); -- cgit v1.2.3