mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: reject zero-length SCTs.

Browse source 
The SignedCertificateTimestampList[1] specifies that both the list and
each element must not be empty. Checking that the list is not empty was
handled in [2] and this change checks that the SCTs themselves are not
zero-length.

[1] https://tools.ietf.org/html/rfc6962#section-3.3
[2] https://golang.org/cl/33265

Change-Id: Iabaae7a15f6d111eb079e5086e0bd2005fae9e48
Reviewed-on: https://go-review.googlesource.com/33355
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Adam Langley 2016-11-17 12:15:19 -08:00 • committed by Brad Fitzpatrick
parent 62b1adc302
commit e0a9081770
2 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
handshake_messages.go
View file

@ -813,7 +813,7 @@ func (m *serverHelloMsg) unmarshal(data []byte) bool {
}
sctLen := int(d[0])<<8 | int(d[1])
d = d[2:]
if len(d) < sctLen {
if sctLen == 0 || len(d) < sctLen {
return false
}
m.scts = append(m.scts, d[:sctLen])