diff options
| author | David Benjamin <davidben@chromium.org> | 2014-09-27 02:53:43 +0400 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2014-10-01 02:58:21 +0400 |
| commit | a9ca90abbb8e0324372a91dd1e1d8ef51a1ac91c (patch) | |
| tree | d53653ca7b92c520b5df831aea0ab2476f8de284 /ssl/t1_lib.c | |
| parent | 42e9a77c43580e6c4afa9972d37d8bd129e8f1f0 (diff) | |
Fix ServerHello EC point format extension check.
Use the newly split out tls1_check_point_format. Also don't condition it on
s->tlsext_ecpointformatlist which is unrelated and made this code never run.
Change-Id: I9d77654c8eaebde07079d989cd60fbcf06025d75
Reviewed-on: https://boringssl-review.googlesource.com/1844
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'ssl/t1_lib.c')
| -rw-r--r-- | ssl/t1_lib.c | 27 |
1 files changed, 5 insertions, 22 deletions
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index f41f0cf3..1741bdb7 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -2176,28 +2176,11 @@ static int ssl_check_serverhello_tlsext(SSL *s) */ unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth; - if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && - (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && - ((alg_k & SSL_kEECDH) || (alg_a & SSL_aECDSA))) - { - /* we are using an ECC cipher */ - size_t i; - unsigned char *list; - int found_uncompressed = 0; - list = s->session->tlsext_ecpointformatlist; - for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) - { - if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed) - { - found_uncompressed = 1; - break; - } - } - if (!found_uncompressed) - { - OPENSSL_PUT_ERROR(SSL, ssl_check_serverhello_tlsext, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); - return -1; - } + if (((alg_k & SSL_kEECDH) || (alg_a & SSL_aECDSA)) && + !tls1_check_point_format(s, TLSEXT_ECPOINTFORMAT_uncompressed)) + { + OPENSSL_PUT_ERROR(SSL, ssl_check_serverhello_tlsext, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); + return -1; } ret = SSL_TLSEXT_ERR_OK; |