From a561f3e0969be0b392e4941f340fadf825602c42 Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Fri, 4 Sep 2026 11:24:30 -0300 Subject: [PATCH] reject improper TLS record lengths --- mongoose.c | 11 ++++++++--- src/tls_builtin.c | 11 ++++++++--- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/mongoose.c b/mongoose.c index 5df7cf7e..fe686f46 100644 --- a/mongoose.c +++ b/mongoose.c @@ -16819,9 +16819,14 @@ static void mg_der_debug(struct mg_der_tlv *tlv, int depth) { // Did we receive a full TLS record in the c->rtls buffer? static bool mg_tls_got_record(struct mg_connection *c) { - return c->rtls.len >= (size_t) TLS_RECHDR_SIZE && - c->rtls.len >= - (size_t) (TLS_RECHDR_SIZE + MG_LOAD_BE16(c->rtls.buf + 3)); + uint16_t rl; + if (c->rtls.len < (size_t) TLS_RECHDR_SIZE) return false; + rl = MG_LOAD_BE16(c->rtls.buf + 3); + if (rl > 16384 + 256) { // TLS 1.3 record max length (RFC-9846 5.1) + mg_error(c, "TLS record too large"); + return false; + } + return c->rtls.len >= (size_t) (TLS_RECHDR_SIZE + rl); } // Remove a single TLS record from the recv buffer diff --git a/src/tls_builtin.c b/src/tls_builtin.c index e9ddd11e..07cdfc40 100644 --- a/src/tls_builtin.c +++ b/src/tls_builtin.c @@ -267,9 +267,14 @@ static void mg_der_debug(struct mg_der_tlv *tlv, int depth) { // Did we receive a full TLS record in the c->rtls buffer? static bool mg_tls_got_record(struct mg_connection *c) { - return c->rtls.len >= (size_t) TLS_RECHDR_SIZE && - c->rtls.len >= - (size_t) (TLS_RECHDR_SIZE + MG_LOAD_BE16(c->rtls.buf + 3)); + uint16_t rl; + if (c->rtls.len < (size_t) TLS_RECHDR_SIZE) return false; + rl = MG_LOAD_BE16(c->rtls.buf + 3); + if (rl > 16384 + 256) { // TLS 1.3 record max length (RFC-9846 5.1) + mg_error(c, "TLS record too large"); + return false; + } + return c->rtls.len >= (size_t) (TLS_RECHDR_SIZE + rl); } // Remove a single TLS record from the recv buffer