b8524a
From 30238f96081e47178237e58f5229850514858fd3 Mon Sep 17 00:00:00 2001
b8524a
From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
b8524a
Date: Tue, 15 Nov 2016 06:33:36 +0000
b8524a
Subject: [PATCH] merge revision(s) 53064: [Backport #11810]
b8524a
b8524a
	* ext/openssl/ossl_ssl.c (ssl_npn_select_cb_common): fix parsing
b8524a
	  protocol list.
b8524a
	  The protocol list from OpenSSL is not null-terminated.
b8524a
	  patched by Kazuki Yamaguchi [Bug #11810] [ruby-core:72082]
b8524a
b8524a
b8524a
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@56798 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
b8524a
---
b8524a
 ChangeLog              |  7 +++++++
b8524a
 ext/openssl/ossl_ssl.c | 17 +++++++----------
b8524a
 2 files changed, 14 insertions(+), 10 deletions(-)
b8524a
b8524a
diff --git a/ChangeLog b/ChangeLog
b8524a
index cae6e73..f8f303e 100644
b8524a
--- a/ChangeLog
b8524a
+++ b/ChangeLog
b8524a
@@ -1,3 +1,10 @@
b8524a
+Tue Nov 15 15:29:36 2016  NARUSE, Yui  <naruse@ruby-lang.org>
b8524a
+
b8524a
+	* ext/openssl/ossl_ssl.c (ssl_npn_select_cb_common): fix parsing
b8524a
+	  protocol list.
b8524a
+	  The protocol list from OpenSSL is not null-terminated.
b8524a
+	  patched by Kazuki Yamaguchi [Bug #11810] [ruby-core:72082]
b8524a
+
b8524a
 Thu Feb 25 19:49:31 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
b8524a
 
b8524a
 	* ext/socket/socket.c (sock_gethostname): support unlimited size
b8524a
diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
b8524a
index 0da1eb1..5b00cb7 100644
b8524a
--- a/ext/openssl/ossl_ssl.c
b8524a
+++ b/ext/openssl/ossl_ssl.c
b8524a
@@ -605,19 +605,16 @@ ssl_npn_select_cb_common(VALUE cb, const unsigned char **out, unsigned char *out
b8524a
 {
b8524a
     VALUE selected;
b8524a
     long len;
b8524a
-    unsigned char l;
b8524a
     VALUE protocols = rb_ary_new();
b8524a
+    unsigned char l;
b8524a
+    const unsigned char *in_end = in + inlen;
b8524a
 
b8524a
-    /* The format is len_1|proto_1|...|len_n|proto_n\0 */
b8524a
-    while (l = *in++) {
b8524a
-	VALUE protocol;
b8524a
-	if (l > inlen) {
b8524a
-	    ossl_raise(eSSLError, "Invalid protocol name list");
b8524a
-	}
b8524a
-	protocol = rb_str_new((const char *)in, l);
b8524a
-	rb_ary_push(protocols, protocol);
b8524a
+    /* assume OpenSSL verifies this format */
b8524a
+    /* The format is len_1|proto_1|...|len_n|proto_n */
b8524a
+    while (in < in_end) {
b8524a
+	l = *in++;
b8524a
+	rb_ary_push(protocols, rb_str_new((const char *)in, l));
b8524a
 	in += l;
b8524a
-	inlen -= l;
b8524a
     }
b8524a
 
b8524a
     selected = rb_funcall(cb, rb_intern("call"), 1, protocols);