Skip to content

dtls.c: add missing length checks in dtls_prepare_record. #275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
boaks wants to merge 1 commit into
base: main
Choose a base branch
from
Open

dtls.c: add missing length checks in dtls_prepare_record. #275

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions dtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1774,6 +1774,10 @@ dtls_prepare_record(dtls_peer_t *peer, dtls_security_parameters_t *security,
} CCMNonceExample;
*/

if (*rlen < DTLS_RH_LENGTH + 8) {

@obgm obgm Sep 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have difficulties wrapping my head around this length check. The storage space for the 8 bytes written after this check are already included in DTLS_RH_LENGTH. Which fields are checked here actually?

@boaks boaks Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On a fast look, it seems that this is already considered in line 1680 with

 if (*rlen < DTLS_RH_LENGTH) {

but the pain comes from the use of epoch+record-sequence-number as explicit nonce.
Therefore I check, if there is space for the 8 bytes of the explicit nonce. These bytes are located direct after the header.

Does this help?

dtls_debug("dtls_prepare_record: send buffer too small\n");
return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR);
}
memcpy(p, &DTLS_RECORD_HEADER(sendbuf)->epoch, 8);
p += 8;
res = 8;
Expand Down Expand Up @@ -1808,6 +1812,11 @@ dtls_prepare_record(dtls_peer_t *peer, dtls_security_parameters_t *security,
memcpy(A_DATA + 8, &DTLS_RECORD_HEADER(sendbuf)->content_type, 3); /* type and version */
dtls_int_to_uint16(A_DATA + 11, res - 8); /* length */

if (*rlen < res + DTLS_RH_LENGTH + mac_len) {
dtls_debug("dtls_prepare_record: send buffer too small\n");
return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR);
}

res = dtls_encrypt_params(&params, start + 8, res - 8, start + 8,
dtls_kb_local_write_key(security, peer->role),
dtls_kb_key_size(security, peer->role),
Expand Down
Loading