ref: 3654e2a6c2ce647628929b994e68185a56f7d7df
parent: f7f5dd6cc304c7d5d24f7783066f82994c639c11
author: Igor Böhm <[email protected]>
date: Tue Sep 27 19:30:40 EDT 2022
limit size and null terminate server name identifier
--- a/tlshand.c
+++ b/tlshand.c
@@ -670,8 +670,11 @@
p += 2;
if(e-p < (n = get16(p-2)))
goto Short;
- c->serverName = emalloc(n);
+ if(n > 255) /* DNS name can not exceed 255 bytes RFC1035 */
+ break;
+ c->serverName = emalloc(n+1);
memmove(c->serverName, p, n);
+ c->serverName[n] = 0;
break;
case Extec:
if(n < 4 || n % 2 || get16(p) != (n -= 2))