From f385fcebee017973cf4137333628a78248f1f443 Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Wed, 16 Nov 2022 10:23:05 +0100 Subject: [PATCH 1/2] tls: Fix in_cid buffer size in transform structure Signed-off-by: Ronald Cron --- include/mbedtls/ssl_internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/mbedtls/ssl_internal.h b/include/mbedtls/ssl_internal.h index 46ade67b9c..77ad755477 100644 --- a/include/mbedtls/ssl_internal.h +++ b/include/mbedtls/ssl_internal.h @@ -782,7 +782,7 @@ struct mbedtls_ssl_transform #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) uint8_t in_cid_len; uint8_t out_cid_len; - unsigned char in_cid [ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; + unsigned char in_cid [ MBEDTLS_SSL_CID_IN_LEN_MAX ]; unsigned char out_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ From 7345073aaff5ec79045cfe792e43b3cc554335e1 Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Wed, 16 Nov 2022 11:04:48 +0100 Subject: [PATCH 2/2] Add ChangeLog Signed-off-by: Ronald Cron --- ChangeLog.d/fix-in-cid-buffer-size.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/fix-in-cid-buffer-size.txt diff --git a/ChangeLog.d/fix-in-cid-buffer-size.txt b/ChangeLog.d/fix-in-cid-buffer-size.txt new file mode 100644 index 0000000000..8a6c850232 --- /dev/null +++ b/ChangeLog.d/fix-in-cid-buffer-size.txt @@ -0,0 +1,4 @@ +Security + * Fix potential heap buffer overread and overwrite in DTLS if + MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and + MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.