Skip to content

dtls.c: fix length check in check_server_certificate.#267

Merged
boaks merged 1 commit intomainfrom
fix_length_check_server_cert
Mar 18, 2026
Merged

dtls.c: fix length check in check_server_certificate.#267
boaks merged 1 commit intomainfrom
fix_length_check_server_cert

Conversation

@boaks
Copy link
Copy Markdown
Contributor

@boaks boaks commented Mar 17, 2026

Fixes potential out-of-bounds read.

@boaks
Copy link
Copy Markdown
Contributor Author

boaks commented Mar 17, 2026

@obgm

Please a fast LGTM, thanks!

dtls.c Outdated

data += DTLS_HS_LENGTH;

if (data_length < DTLS_HS_LENGTH + DTLS_EC_SUBJECTPUBLICKEY_SIZE + sizeof(uint24)) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good in general but I think this check should come before doing the update_hs_hash in line 3433 .

Otherwise, LGTM.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

Fixes potential out-of-bounds read.

Signed-off-by: Achim Kraus <achim.kraus@cloudcoap.net>
@boaks boaks force-pushed the fix_length_check_server_cert branch from 612e9f7 to 3894c78 Compare March 18, 2026 06:35
@boaks boaks merged commit b3efd41 into main Mar 18, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants