Merge pull request #17 from mustakcsecuet/fixer

FIX #16: Security patch for information leak.
bl4ck5un · Nov 1, 2019 · eab8e36 · eab8e36
2 parents 75ede26 + f5543da
commit eab8e36
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 11 deletions.
diff --git a/example/enclave/s_server.c b/example/enclave/s_server.c
@@ -1863,6 +1863,7 @@ int ssl_server()
         ret = 0;
         goto exit;
       }
+
 #if !defined(_WIN32)
         if( received_sigterm )
         {

diff --git a/trusted/mbedtls-2.6.0/library/ssl_tls.c b/trusted/mbedtls-2.6.0/library/ssl_tls.c
@@ -2429,21 +2429,29 @@ int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
         return( 0 );
     }
 
-    while( ssl->out_left > 0 )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
-                       mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
+    while (ssl->out_left > 0) {
+      MBEDTLS_SSL_DEBUG_MSG(2, ("message length: %d, out_left: %d",
+                                mbedtls_ssl_hdr_len(ssl) + ssl->out_msglen,
+                                ssl->out_left));
 
-        buf = ssl->out_hdr + mbedtls_ssl_hdr_len( ssl ) +
-              ssl->out_msglen - ssl->out_left;
-        ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left );
+      buf = ssl->out_hdr + mbedtls_ssl_hdr_len(ssl) + ssl->out_msglen -
+            ssl->out_left;
+      ret = ssl->f_send(ssl->p_bio, buf, ssl->out_left);
 
-        MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
+      MBEDTLS_SSL_DEBUG_RET(2, "ssl->f_send", ret);
 
-        if( ret <= 0 )
-            return( ret );
+      if (ret <= 0)
+        return (ret);
+
+      if ((size_t)ret > ssl->out_left ||
+          (INT_MAX > SIZE_MAX && ret > SIZE_MAX)) {
+        MBEDTLS_SSL_DEBUG_MSG(
+            1, ("f_send returned %d bytes but only %lu bytes were sent", ret,
+                (unsigned long)ssl->out_left));
+        return (MBEDTLS_ERR_SSL_INTERNAL_ERROR);
+      }
 
-        ssl->out_left -= ret;
+      ssl->out_left -= ret;
     }
 
     for( i = 8; i > ssl_ep_len( ssl ); i-- )