[openssl.org #3361] [PATCH] inadequate buffer size in ssl3_send_certificate_request

[David Ramos via RT]

Hello,

Our UC-KLEE tool found an out-of-bounds write bug in 
ssl3_send_certificate_request (ssl/s3_srvr.c) caused by allocating an 
insufficiently large buffer. It appears that NETSCAPE_HANG_BUG is defined to 
append the 4-byte ServerDone message to the CertificateRequest message, but the 
necessary space is not requested by the allocation:
  if (!BUF_MEM_grow_clean(buf,4+n+j+2))

(I believe the hard-coded 4 in that line refers to the 4-byte message header 
for the CertificateRequest, not the subsequent ServerDone.)

This bug affects OpenSSL 1.0.1 and likely other branches as well.

Attached is a suggested patch, which is perhaps preferable to adding another 
opaque "+4" to the allocation site.

Thanks,
-David

ssl3_send_certificate_request-bufsize.patch
Description: Binary data