min
/
boring2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Guard against empty strings given to select_next_proto (#252)

This commit is contained in:
Anthony Ramine 2024-08-02 09:26:03 +02:00 committed by GitHub
parent 5e304d9248
commit 8ece78238c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
boring/src/ssl/mod.rs
View File

@ -815,6 +815,10 @@ impl CompliancePolicy {
/// [`SslContextBuilder::set_alpn_protos`]: struct.SslContextBuilder.html#method.set_alpn_protos /// [`SslContextBuilder::set_alpn_protos`]: struct.SslContextBuilder.html#method.set_alpn_protos
/// [`SSL_select_next_proto`]: https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_alpn_protos.html /// [`SSL_select_next_proto`]: https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_alpn_protos.html
pub fn select_next_proto<'a>(server: &[u8], client: &'a [u8]) -> Option<&'a [u8]> { pub fn select_next_proto<'a>(server: &[u8], client: &'a [u8]) -> Option<&'a [u8]> {
if server.is_empty() || client.is_empty() {
return None;
}
unsafe { unsafe {
let mut out = ptr::null_mut(); let mut out = ptr::null_mut();
let mut outlen = 0; let mut outlen = 0;
@ -826,6 +830,7 @@ pub fn select_next_proto<'a>(server: &[u8], client: &'a [u8]) -> Option<&'a [u8]
client.as_ptr(), client.as_ptr(),
client.len() as c_uint, client.len() as c_uint,
); );
if r == ffi::OPENSSL_NPN_NEGOTIATED { if r == ffi::OPENSSL_NPN_NEGOTIATED {
Some(slice::from_raw_parts(out as *const u8, outlen as usize)) Some(slice::from_raw_parts(out as *const u8, outlen as usize))
} else { } else {

7
boring/src/ssl/test/mod.rs
View File

@ -275,6 +275,13 @@ fn test_alpn_server_select_none() {
assert_eq!(None, s.ssl().selected_alpn_protocol()); assert_eq!(None, s.ssl().selected_alpn_protocol());
} }
#[test]
fn test_empty_alpn() {
assert_eq!(ssl::select_next_proto(b"", b""), None);
assert_eq!(ssl::select_next_proto(b"", b"\x08http/1.1"), None);
assert_eq!(ssl::select_next_proto(b"\x08http/1.1", b""), None);
}
#[test] #[test]
fn test_alpn_server_unilateral() { fn test_alpn_server_unilateral() {
let server = Server::builder().build(); let server = Server::builder().build();