Project

General

Profile

Actions

Bug #4297

closed

ssl : Integer underflow in ssl parsing SSLV3_HANDSHAKE_PROTOCOL

Added by Jeff Lucovsky 9 months ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28399

First we being parsing SSLV3_HANDSHAKE_PROTOCOL
We set message_start, bytes_processed and message_length in SSLv3ParseHandshakeProtocol

Then, we break out of this SSLV3_HANDSHAKE_PROTOCOL parsing because the other side of the connexion set SSL_AL_FLAG_CHANGE_CIPHER_SPEC
This leads to increasing bytes_processed at the end of SSLv3Decode

Then, we do not break anymore out of this SSLV3_HANDSHAKE_PROTOCOL parsing because the other side set SSL_AL_FLAG_STATE_CLIENT_HELLO
And bytes_processed is now over message_start + message_length

Actions #2

Updated by Jeff Lucovsky 9 months ago

  • Status changed from Assigned to In Progress
Actions #3

Updated by Jeff Lucovsky 8 months ago

  • Status changed from In Progress to In Review
Actions #6

Updated by Jeff Lucovsky 8 months ago

  • Status changed from In Review to Closed
Actions #7

Updated by Jeff Lucovsky 7 months ago

  • Private changed from Yes to No
Actions

Also available in: Atom PDF