diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-09-23 16:53:17 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-09-28 13:57:00 +0000 |
| commit | fc1a02c93ba4c9a98e329a4166618bbaf17d584b (patch) | |
| tree | 4235ed378bdbf8aa55d99a692a5f47868b31aff4 /include | |
| parent | f80f8c38fada66163324e509d9eb6b2c844d7c58 (diff) | |
ktls: Fix an off-by-one bug in tls13_find_record_type()
If the entire plaintext is zero-filled, the backwards walk in
tls13_find_record_type() would return the offset of the last byte of the
TLS header. This causes an underflow when decrypting, resulting in a
null pointer dereference.
Fix the bug and add a regression test.
Reviewed by: gallatin, jhb
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59767
(cherry picked from commit 7c5e457d3afdc7742ee24f0b5ee6e5e7aa00a6bd)
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions