wt/mongoose
1
0
Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-09-30 21:42:42 +07:00
Code Issues Packages Projects Releases Wiki Activity

reject improper TLS record lengths

Browse Source
This commit is contained in:
Sergio R. Caprile
2026-09-04 11:24:30 -03:00
parent 2b0a5e9701
commit a561f3e096
2 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mongoose.c
+8 -3
View File
@@ -16819,9 +16819,14 @@ static void mg_der_debug(struct mg_der_tlv *tlv, int depth) {
// Did we receive a full TLS record in the c->rtls buffer?
static bool mg_tls_got_record(struct mg_connection *c) {
return c->rtls.len >= (size_t) TLS_RECHDR_SIZE &&
c->rtls.len >=
(size_t) (TLS_RECHDR_SIZE + MG_LOAD_BE16(c->rtls.buf + 3));
uint16_t rl;
if (c->rtls.len < (size_t) TLS_RECHDR_SIZE) return false;
rl = MG_LOAD_BE16(c->rtls.buf + 3);
if (rl > 16384 + 256) { // TLS 1.3 record max length (RFC-9846 5.1)
mg_error(c, "TLS record too large");
return false;
}
return c->rtls.len >= (size_t) (TLS_RECHDR_SIZE + rl);
}
// Remove a single TLS record from the recv buffer
src/tls_builtin.c
+8 -3
View File
@@ -267,9 +267,14 @@ static void mg_der_debug(struct mg_der_tlv *tlv, int depth) {
// Did we receive a full TLS record in the c->rtls buffer?
static bool mg_tls_got_record(struct mg_connection *c) {
return c->rtls.len >= (size_t) TLS_RECHDR_SIZE &&
c->rtls.len >=
(size_t) (TLS_RECHDR_SIZE + MG_LOAD_BE16(c->rtls.buf + 3));
uint16_t rl;
if (c->rtls.len < (size_t) TLS_RECHDR_SIZE) return false;
rl = MG_LOAD_BE16(c->rtls.buf + 3);
if (rl > 16384 + 256) { // TLS 1.3 record max length (RFC-9846 5.1)
mg_error(c, "TLS record too large");
return false;
}
return c->rtls.len >= (size_t) (TLS_RECHDR_SIZE + rl);
}
// Remove a single TLS record from the recv buffer