mmo-ref/dep-openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a one byte buffer overflow in s_client

Browse source 
The buffer used to process user commands when using advanced mode ("-adv")
can overflow the buffer by one byte if the the read buffer is exactly
BUFSIZZ bytes in length (16k). When processing the buffer we add a NUL
terminator to the buffer, so if the buffer is already full then we
overwrite by one byte when we add the NUL terminator.

This does not represent a security issue because this is entirely local
and would be "self-inflicted", i.e. not under attacker control.

This issue was reported to use by Igor Morgenstern from AISLE.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar 12 17:56:37 2026
(Merged from https://github.com/openssl/openssl/pull/30376)

(cherry picked from commit 440ac348bf)
This commit is contained in:
Matt Caswell 2026-03-11 15:06:32 +00:00 • committed by Tomas Mraz
parent 3e9863ade4
commit e0e276b50a
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apps/s_client.c
View file

@ -3923,7 +3923,11 @@ static void user_data_init(struct user_data_st *user_data, SSL *con, char *buf,
static int user_data_add(struct user_data_st *user_data, size_t i)
{
if (user_data->buflen != 0 || i > user_data->bufmax)
/*
* We must allow one byte for a NUL terminator so i must be less than
* bufmax
*/
if (user_data->buflen != 0 || i >= user_data->bufmax)
return 0;
user_data->buflen = i;