mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-17 14:32:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add checks on return code when applying some settings.

Browse Source 
Remove hardcoded bound checkings.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3141)
This commit is contained in:
FdaSilvaYY 2017-04-07 19:15:38 +02:00 committed by Richard Levitte
parent 67887855af
commit 36b2cfb191
2 changed files with 42 additions and 77 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
apps/s_client.c
View File

@ -665,11 +665,11 @@ const OPTIONS s_client_options[] = {
{"async", OPT_ASYNC, '-', "Support asynchronous operation"}, {"async", OPT_ASYNC, '-', "Support asynchronous operation"},
{"ssl_config", OPT_SSL_CONFIG, 's', "Use specified configuration file"}, {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified configuration file"},
{"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "}, {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "},
{"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'p',
"Size used to split data for encrypt pipelines"}, "Size used to split data for encrypt pipelines"},
{"max_pipelines", OPT_MAX_PIPELINES, 'n', {"max_pipelines", OPT_MAX_PIPELINES, 'p',
"Maximum number of encrypt/decrypt pipelines to be used"}, "Maximum number of encrypt/decrypt pipelines to be used"},
{"read_buf", OPT_READ_BUF, 'n', {"read_buf", OPT_READ_BUF, 'p',
"Default read buffer size to be used for connections"}, "Default read buffer size to be used for connections"},
OPT_S_OPTIONS, OPT_S_OPTIONS,
OPT_V_OPTIONS, OPT_V_OPTIONS,
@ -896,7 +896,7 @@ int s_client_main(int argc, char **argv)
int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0; int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0;
int async = 0; int async = 0;
unsigned int max_send_fragment = 0; unsigned int max_send_fragment = 0;
unsigned int split_send_fragment = 0, max_pipelines = 0; unsigned int split_send_fragment = 0, max_pipelines = 0;
enum { use_inet, use_unix, use_unknown } connect_type = use_unknown; enum { use_inet, use_unix, use_unknown } connect_type = use_unknown;
int count4or6 = 0; int count4or6 = 0;
int c_nbio = 0, c_msg = 0, c_ign_eof = 0, c_brief = 0; int c_nbio = 0, c_msg = 0, c_ign_eof = 0, c_brief = 0;
@ -1381,23 +1381,9 @@ int s_client_main(int argc, char **argv)
break; break;
case OPT_MAX_SEND_FRAG: case OPT_MAX_SEND_FRAG:
max_send_fragment = atoi(opt_arg()); max_send_fragment = atoi(opt_arg());
if (max_send_fragment == 0) {
/*
* Not allowed - set to a deliberately bad value so we get an
* error message below
*/
max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;
}
break; break;
case OPT_SPLIT_SEND_FRAG: case OPT_SPLIT_SEND_FRAG:
split_send_fragment = atoi(opt_arg()); split_send_fragment = atoi(opt_arg());
if (split_send_fragment == 0) {
/*
* Not allowed - set to a deliberately bad value so we get an
* error message below
*/
split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;
}
break; break;
case OPT_MAX_PIPELINES: case OPT_MAX_PIPELINES:
max_pipelines = atoi(opt_arg()); max_pipelines = atoi(opt_arg());
@ -1486,20 +1472,6 @@ int s_client_main(int argc, char **argv)
socket_type = SOCK_STREAM; socket_type = SOCK_STREAM;
} }
#endif #endif
if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
BIO_printf(bio_err, "%s: Bad max send fragment size\n", prog);
goto end;
}
if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
BIO_printf(bio_err, "%s: Bad split send fragment size\n", prog);
goto end;
}
if (max_pipelines > SSL_MAX_PIPELINES) {
BIO_printf(bio_err, "%s: Bad max pipelines value\n", prog);
goto end;
}
#if !defined(OPENSSL_NO_NEXTPROTONEG) #if !defined(OPENSSL_NO_NEXTPROTONEG)
next_proto.status = -1; next_proto.status = -1;
@ -1623,14 +1595,25 @@ int s_client_main(int argc, char **argv)
SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC); SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC);
} }
if (max_send_fragment > 0) if (max_send_fragment > 0
SSL_CTX_set_max_send_fragment(ctx, max_send_fragment); && !SSL_CTX_set_max_send_fragment(ctx, max_send_fragment)) {
BIO_printf(bio_err, "%s: Max send fragment size %u is out of permitted range\n",
if (split_send_fragment > 0) { prog, max_send_fragment);
SSL_CTX_set_split_send_fragment(ctx, split_send_fragment); goto end;
} }
if (max_pipelines > 0) {
SSL_CTX_set_max_pipelines(ctx, max_pipelines); if (split_send_fragment > 0
&& !SSL_CTX_set_split_send_fragment(ctx, split_send_fragment)) {
BIO_printf(bio_err, "%s: Split send fragment size %u is out of permitted range\n",
prog, split_send_fragment);
goto end;
}
if (max_pipelines > 0
&& !SSL_CTX_set_max_pipelines(ctx, max_pipelines)) {
BIO_printf(bio_err, "%s: Max pipelines %u is out of permitted range\n",
prog, max_pipelines);
goto end;
} }
if (read_buf_len > 0) { if (read_buf_len > 0) {

58
apps/s_server.c
View File

@ -858,11 +858,11 @@ const OPTIONS s_server_options[] = {
{"ssl_config", OPT_SSL_CONFIG, 's', {"ssl_config", OPT_SSL_CONFIG, 's',
"Configure SSL_CTX using the configuration 'val'"}, "Configure SSL_CTX using the configuration 'val'"},
{"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "}, {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "},
{"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'p',
"Size used to split data for encrypt pipelines"}, "Size used to split data for encrypt pipelines"},
{"max_pipelines", OPT_MAX_PIPELINES, 'n', {"max_pipelines", OPT_MAX_PIPELINES, 'p',
"Maximum number of encrypt/decrypt pipelines to be used"}, "Maximum number of encrypt/decrypt pipelines to be used"},
{"read_buf", OPT_READ_BUF, 'n', {"read_buf", OPT_READ_BUF, 'p',
"Default read buffer size to be used for connections"}, "Default read buffer size to be used for connections"},
OPT_S_OPTIONS, OPT_S_OPTIONS,
OPT_V_OPTIONS, OPT_V_OPTIONS,
@ -1502,23 +1502,9 @@ int s_server_main(int argc, char *argv[])
break; break;
case OPT_MAX_SEND_FRAG: case OPT_MAX_SEND_FRAG:
max_send_fragment = atoi(opt_arg()); max_send_fragment = atoi(opt_arg());
if (max_send_fragment == 0) {
/*
* Not allowed - set to a deliberately bad value so we get an
* error message below
*/
max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;
}
break; break;
case OPT_SPLIT_SEND_FRAG: case OPT_SPLIT_SEND_FRAG:
split_send_fragment = atoi(opt_arg()); split_send_fragment = atoi(opt_arg());
if (split_send_fragment == 0) {
/*
* Not allowed - set to a deliberately bad value so we get an
* error message below
*/
split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;
}
break; break;
case OPT_MAX_PIPELINES: case OPT_MAX_PIPELINES:
max_pipelines = atoi(opt_arg()); max_pipelines = atoi(opt_arg());
@ -1574,20 +1560,6 @@ int s_server_main(int argc, char *argv[])
socket_type = SOCK_STREAM; socket_type = SOCK_STREAM;
} }
#endif #endif
if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
BIO_printf(bio_err, "%s: Bad max send fragment size\n", prog);
goto end;
}
if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
BIO_printf(bio_err, "%s:Bad split send fragment size\n", prog);
goto end;
}
if (max_pipelines > SSL_MAX_PIPELINES) {
BIO_printf(bio_err, "%s:too large max-pipelines value\n", prog);
goto end;
}
if (!app_passwd(passarg, dpassarg, &pass, &dpass)) { if (!app_passwd(passarg, dpassarg, &pass, &dpass)) {
BIO_printf(bio_err, "Error getting password\n"); BIO_printf(bio_err, "Error getting password\n");
@ -1778,14 +1750,24 @@ int s_server_main(int argc, char *argv[])
SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC); SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC);
} }
if (max_send_fragment > 0) if (max_send_fragment > 0
SSL_CTX_set_max_send_fragment(ctx, max_send_fragment); && !SSL_CTX_set_max_send_fragment(ctx, max_send_fragment)) {
BIO_printf(bio_err, "%s: Max send fragment size %u is out of permitted range\n",
if (split_send_fragment > 0) { prog, max_send_fragment);
SSL_CTX_set_split_send_fragment(ctx, split_send_fragment); goto end;
} }
if (max_pipelines > 0) {
SSL_CTX_set_max_pipelines(ctx, max_pipelines); if (split_send_fragment > 0
&& !SSL_CTX_set_split_send_fragment(ctx, split_send_fragment)) {
BIO_printf(bio_err, "%s: Split send fragment size %u is out of permitted range\n",
prog, split_send_fragment);
goto end;
}
if (max_pipelines > 0
&& !SSL_CTX_set_max_pipelines(ctx, max_pipelines)) {
BIO_printf(bio_err, "%s: Max pipelines %u is out of permitted range\n",
prog, max_pipelines);
goto end;
} }
if (read_buf_len > 0) { if (read_buf_len > 0) {