From f473eb72066e02d44837fd77110b6ca5bdea97e2 Mon Sep 17 00:00:00 2001 From: Emeric Brun Date: Tue, 27 Jun 2023 15:24:05 +0200 Subject: [PATCH] BUG/MEDIUM: quic: error checking buffer large enought to receive the retry tag Building a retry message, the offset of the tag was checked instead of the remaining length into the buffer. Must be backported as far as 2.6. --- src/quic_conn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/quic_conn.c b/src/quic_conn.c index ed15f53ed..caf04a244 100644 --- a/src/quic_conn.c +++ b/src/quic_conn.c @@ -6677,7 +6677,7 @@ static int send_retry(int fd, struct sockaddr_storage *addr, i += token_len; /* token integrity tag */ - if ((&buf[i] - buf < QUIC_TLS_TAG_LEN) || + if ((sizeof(buf) - i < QUIC_TLS_TAG_LEN) || !quic_tls_generate_retry_integrity_tag(pkt->dcid.data, pkt->dcid.len, buf, i, qv)) { TRACE_ERROR("quic_tls_generate_retry_integrity_tag() failed", QUIC_EV_CONN_TXPKT);