isaacpittman-hitachi / rpms / openssl

Forked from rpms/openssl 2 years ago
Clone

Blame SOURCES/0048-correctly-handle-records.patch

f57b16
diff -up openssl-3.0.1/apps/s_server.c.handle-records openssl-3.0.1/apps/s_server.c
f57b16
--- openssl-3.0.1/apps/s_server.c.handle-records	2022-02-03 15:26:16.803434943 +0100
f57b16
+++ openssl-3.0.1/apps/s_server.c	2022-02-03 15:34:33.358298697 +0100
f57b16
@@ -2982,7 +2982,9 @@ static int www_body(int s, int stype, in
f57b16
     /* Set width for a select call if needed */
f57b16
     width = s + 1;
f57b16
 
f57b16
-    buf = app_malloc(bufsize, "server www buffer");
f57b16
+    /* as we use BIO_gets(), and it always null terminates data, we need
f57b16
+     * to allocate 1 byte longer buffer to fit the full 2^14 byte record */
f57b16
+    buf = app_malloc(bufsize + 1, "server www buffer");
f57b16
     io = BIO_new(BIO_f_buffer());
f57b16
     ssl_bio = BIO_new(BIO_f_ssl());
f57b16
     if ((io == NULL) || (ssl_bio == NULL))
f57b16
@@ -3047,7 +3049,7 @@ static int www_body(int s, int stype, in
f57b16
     }
f57b16
 
f57b16
     for (;;) {
f57b16
-        i = BIO_gets(io, buf, bufsize - 1);
f57b16
+        i = BIO_gets(io, buf, bufsize + 1);
f57b16
         if (i < 0) {            /* error */
f57b16
             if (!BIO_should_retry(io) && !SSL_waiting_for_async(con)) {
f57b16
                 if (!s_quiet)
f57b16
@@ -3112,7 +3114,7 @@ static int www_body(int s, int stype, in
f57b16
                  * we're expecting to come from the client. If they haven't
f57b16
                  * sent one there's not much we can do.
f57b16
                  */
f57b16
-                BIO_gets(io, buf, bufsize - 1);
f57b16
+                BIO_gets(io, buf, bufsize + 1);
f57b16
             }
f57b16
 
f57b16
             BIO_puts(io,
f57b16
@@ -3401,7 +3403,9 @@ static int rev_body(int s, int stype, in
f57b16
     SSL *con;
f57b16
     BIO *io, *ssl_bio, *sbio;
f57b16
 
f57b16
-    buf = app_malloc(bufsize, "server rev buffer");
f57b16
+    /* as we use BIO_gets(), and it always null terminates data, we need
f57b16
+     * to allocate 1 byte longer buffer to fit the full 2^14 byte record */
f57b16
+    buf = app_malloc(bufsize + 1, "server rev buffer");
f57b16
     io = BIO_new(BIO_f_buffer());
f57b16
     ssl_bio = BIO_new(BIO_f_ssl());
f57b16
     if ((io == NULL) || (ssl_bio == NULL))
f57b16
@@ -3476,7 +3480,7 @@ static int rev_body(int s, int stype, in
f57b16
     print_ssl_summary(con);
f57b16
 
f57b16
     for (;;) {
f57b16
-        i = BIO_gets(io, buf, bufsize - 1);
f57b16
+        i = BIO_gets(io, buf, bufsize + 1);
f57b16
         if (i < 0) {            /* error */
f57b16
             if (!BIO_should_retry(io)) {
f57b16
                 if (!s_quiet)