Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upcrypto/tls: keysFromMasterSecret() takes len(clientRandom), but should be server #13181
Labels
Comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
CL https://golang.org/cl/16697 mentions this issue. |
FiloSottile
pushed a commit
to FiloSottile/go
that referenced
this issue
Oct 12, 2018
In keysFromMasterSecret(), don't copy from serverRandom into seed[:len(clientRandom)]. Actually, switch from an array to a slice in keysFromMasterSecret() and masterFromPreMasterSecret() so the length need not be given; that's how it's done elsewhere in the file. Fixes golang#13181 Change-Id: I92abaa892d1bba80c2d4f12776341cda7d538837 Reviewed-on: https://go-review.googlesource.com/16697 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
FiloSottile
pushed a commit
to FiloSottile/go
that referenced
this issue
Oct 12, 2018
In keysFromMasterSecret(), don't copy from serverRandom into seed[:len(clientRandom)]. Actually, switch from an array to a slice in keysFromMasterSecret() and masterFromPreMasterSecret() so the length need not be given; that's how it's done elsewhere in the file. Fixes golang#13181 Change-Id: I92abaa892d1bba80c2d4f12776341cda7d538837 Reviewed-on: https://go-review.googlesource.com/16697 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Hi @agl,
keysFromMasterSecret() in crypto/tls/prf.go does
The first len() should be of serverRandom, not clientRandom. It looks like a copy-and-paste error from the previous masterFromPreMasterSecret(). (They're the same length AFAIK, so no fault occurs.)
But I think both functions could have the first copy() be copy(seed, ...) as used elsewhere in prf.go.