Skip to content

Fix oob reads in dtls check tls extension #276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
boaks wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Fix oob reads in dtls check tls extension #276

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f198c49
dtls.c: verify_ext_eliptic_curves fix length checks.
boaks Jun 27, 2026
103a991
dtls.c: verify_ext_cert_type fix length checks.
boaks Jun 27, 2026
b706a59
dtls.c: verify_ext_ec_point_formats fix length checks.
boaks Jun 27, 2026
720d6d1
dtls.c: verify_ext_sig_hash_algo fix length checks.
boaks Jun 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 27 additions & 22 deletions dtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1105,17 +1105,18 @@ calculate_key_block(dtls_context_t *ctx,
* searches for a specific key */
static int
verify_ext_eliptic_curves(uint8 *data, size_t data_length) {
int i, curve_name;
uint16_t i, curve_name;

GET_VAR_FIELD(i, data, data_length, uint16, DTLS_ALERT_HANDSHAKE_FAILURE,
"elliptic curves, length exceeds data");

/* length of curve list */
i = dtls_uint16_to_int(data);
data += sizeof(uint16);
if (i + sizeof(uint16) != data_length) {
if (i != data_length) {
dtls_warn("the list of the supported elliptic curves should be tls extension length - 2\n");
return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE);
}

for (i = data_length - sizeof(uint16); i > 0; i -= sizeof(uint16)) {
for (; i > 0; i -= sizeof(uint16)) {
/* check if this curve is supported */
curve_name = dtls_uint16_to_int(data);
data += sizeof(uint16);
Expand All @@ -1129,17 +1130,18 @@ verify_ext_eliptic_curves(uint8 *data, size_t data_length) {
}

static int verify_ext_cert_type(uint8 *data, size_t data_length) {
int i, cert_type;
uint8_t i, cert_type;

GET_VAR_FIELD(i, data, data_length, uint8, DTLS_ALERT_HANDSHAKE_FAILURE,
"certificate types, length exceeds data");

/* length of cert type list */
i = dtls_uint8_to_int(data);
data += sizeof(uint8);
if (i + sizeof(uint8) != data_length) {
if (i != data_length) {
dtls_warn("the list of the supported certificate types should be tls extension length - 1\n");
return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE);
}

for (i = data_length - sizeof(uint8); i > 0; i -= sizeof(uint8)) {
for (; i > 0; i -= sizeof(uint8)) {
/* check if this cert type is supported */
cert_type = dtls_uint8_to_int(data);
data += sizeof(uint8);
Expand All @@ -1153,17 +1155,18 @@ static int verify_ext_cert_type(uint8 *data, size_t data_length) {
}

static int verify_ext_ec_point_formats(uint8 *data, size_t data_length) {
int i, cert_type;
uint8_t i, cert_type;

GET_VAR_FIELD(i, data, data_length, uint8, DTLS_ALERT_HANDSHAKE_FAILURE,
"ec_point_formats, length exceeds data");

/* length of ec_point_formats list */
i = dtls_uint8_to_int(data);
data += sizeof(uint8);
if (i + sizeof(uint8) != data_length) {
if (i != data_length) {
dtls_warn("the list of the supported ec_point_formats should be tls extension length - 1\n");
return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE);
}

for (i = data_length - sizeof(uint8); i > 0; i -= sizeof(uint8)) {
for (; i > 0; i -= sizeof(uint8)) {
/* check if this ec_point_format is supported */
cert_type = dtls_uint8_to_int(data);
data += sizeof(uint8);
Expand All @@ -1177,17 +1180,19 @@ static int verify_ext_ec_point_formats(uint8 *data, size_t data_length) {
}

static int verify_ext_sig_hash_algo(uint8 *data, size_t data_length) {
int i, hash_type, sig_type;
uint16_t i;
uint8_t hash_type, sig_type;

GET_VAR_FIELD(i, data, data_length, uint16, DTLS_ALERT_HANDSHAKE_FAILURE,
"sig_hash_algorithms, length exceeds data");

/* length of sig_hash_algo list */
i = dtls_uint16_to_int(data);
data += sizeof(uint16);
if (i + sizeof(uint16) != data_length) {
if (i != data_length) {
dtls_warn("the list of the supported signature_algorithms should be tls extension length - 2\n");
return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE);
}

for (i = data_length - sizeof(uint16); i > 0; i -= sizeof(uint16)) {
for (; i > 0; i -= sizeof(uint16)) {
/* check if this _sig_hash_algo is supported */
hash_type = dtls_uint8_to_int(data);
data += sizeof(uint8);
Expand Down Expand Up @@ -1264,7 +1269,7 @@ dtls_check_tls_extension(dtls_peer_t *peer,
if (verify_ext_cert_type(data, j))
goto error;
} else {
if (dtls_uint8_to_int(data) != TLS_CERT_TYPE_RAW_PUBLIC_KEY)
if (j < sizeof(uint8) || dtls_uint8_to_int(data) != TLS_CERT_TYPE_RAW_PUBLIC_KEY)
goto error;
}
break;
Expand All @@ -1274,7 +1279,7 @@ dtls_check_tls_extension(dtls_peer_t *peer,
if (verify_ext_cert_type(data, j))
goto error;
} else {
if (dtls_uint8_to_int(data) != TLS_CERT_TYPE_RAW_PUBLIC_KEY)
if (j < sizeof(uint8) || dtls_uint8_to_int(data) != TLS_CERT_TYPE_RAW_PUBLIC_KEY)
goto error;
}
break;
Expand Down
Loading