You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
110 lines
2.8 KiB
110 lines
2.8 KiB
diff --git a/lib/ext/status_request.c b/lib/ext/status_request.c |
|
index 8cefc61..c7c065e 100644 |
|
--- a/lib/ext/status_request.c |
|
+++ b/lib/ext/status_request.c |
|
@@ -1,5 +1,6 @@ |
|
/* |
|
- * Copyright (C) 2012 Free Software Foundation, Inc. |
|
+ * Copyright (C) 2012-2017 Free Software Foundation, Inc. |
|
+ * Copyright (C) 2017 Red Hat, Inc. |
|
* |
|
* Author: Simon Josefsson, Nikos Mavrogiannopoulos |
|
* |
|
@@ -66,18 +67,6 @@ typedef struct { |
|
opaque Extensions<0..2^16-1>; |
|
*/ |
|
|
|
-static void deinit_responder_id(status_request_ext_st *priv) |
|
-{ |
|
-unsigned i; |
|
- |
|
- for (i = 0; i < priv->responder_id_size; i++) |
|
- gnutls_free(priv->responder_id[i].data); |
|
- |
|
- gnutls_free(priv->responder_id); |
|
- priv->responder_id = NULL; |
|
- priv->responder_id_size = 0; |
|
-} |
|
- |
|
|
|
static int |
|
client_send(gnutls_session_t session, |
|
@@ -132,8 +121,8 @@ server_recv(gnutls_session_t session, |
|
status_request_ext_st * priv, |
|
const uint8_t * data, size_t size) |
|
{ |
|
- size_t i; |
|
ssize_t data_size = size; |
|
+ unsigned rid_bytes = 0; |
|
|
|
/* minimum message is type (1) + responder_id_list (2) + |
|
request_extension (2) = 5 */ |
|
@@ -152,43 +141,17 @@ server_recv(gnutls_session_t session, |
|
DECR_LEN(data_size, 1); |
|
data++; |
|
|
|
- priv->responder_id_size = _gnutls_read_uint16(data); |
|
+ rid_bytes = _gnutls_read_uint16(data); |
|
|
|
DECR_LEN(data_size, 2); |
|
- data += 2; |
|
+ /*data += 2;*/ |
|
|
|
- if (data_size <= (ssize_t) (priv->responder_id_size * 2)) |
|
+ /* sanity check only, we don't use any of the data below */ |
|
+ |
|
+ if (data_size < (ssize_t)rid_bytes) |
|
return |
|
gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); |
|
|
|
- if (priv->responder_id != NULL) |
|
- deinit_responder_id(priv); |
|
- |
|
- priv->responder_id = gnutls_calloc(1, priv->responder_id_size |
|
- * sizeof(*priv->responder_id)); |
|
- if (priv->responder_id == NULL) |
|
- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); |
|
- |
|
- for (i = 0; i < priv->responder_id_size; i++) { |
|
- size_t l; |
|
- |
|
- DECR_LEN(data_size, 2); |
|
- |
|
- l = _gnutls_read_uint16(data); |
|
- data += 2; |
|
- |
|
- DECR_LEN(data_size, l); |
|
- |
|
- priv->responder_id[i].data = gnutls_malloc(l); |
|
- if (priv->responder_id[i].data == NULL) |
|
- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); |
|
- |
|
- memcpy(priv->responder_id[i].data, data, l); |
|
- priv->responder_id[i].size = l; |
|
- |
|
- data += l; |
|
- } |
|
- |
|
return 0; |
|
} |
|
|
|
@@ -472,11 +435,18 @@ gnutls_certificate_set_ocsp_status_request_file |
|
static void _gnutls_status_request_deinit_data(extension_priv_data_t epriv) |
|
{ |
|
status_request_ext_st *priv = epriv.ptr; |
|
+ unsigned i; |
|
|
|
if (priv == NULL) |
|
return; |
|
|
|
- deinit_responder_id(priv); |
|
+ if (priv->responder_id != NULL) { |
|
+ for (i = 0; i < priv->responder_id_size; i++) |
|
+ gnutls_free(priv->responder_id[i].data); |
|
+ |
|
+ gnutls_free(priv->responder_id); |
|
+ } |
|
+ |
|
gnutls_free(priv->request_extensions.data); |
|
gnutls_free(priv->response.data); |
|
gnutls_free(priv);
|
|
|