mirrors/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-01-23 09:46:04 -05:00
Code Issues Projects Releases Packages Wiki Activity

LibTLS: Do not process_message() the finished message twice

Browse source 
With two different sequence numbers to boot!
Fixes #3273
This commit is contained in:
AnotherTest 2020-08-24 06:48:40 +04:30 committed by Andreas Kling
parent 7a2b5d1328
commit 0be3937be7
Notes: sideshowbarker 2024-07-19 03:13:57 +09:00 
Author: https://github.com/alimpfard
Commit: https://github.com/SerenityOS/serenity/commit/0be3937be7b
Pull-request: https://github.com/SerenityOS/serenity/pull/3278
Issue: https://github.com/SerenityOS/serenity/issues/3273
2 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Libraries/LibTLS/ClientHandshake.cpp
View file

@ -216,7 +216,6 @@ ssize_t TLSv12::handle_finished(const ByteBuffer& buffer, WritePacketStage& writ
size_t index = 3;
u32 size = buffer[0] * 0x10000 + buffer[1] * 0x100 + buffer[2];
index += 3;
if (size < 12) {
#ifdef TLS_DEBUG
@ -248,7 +247,7 @@ ssize_t TLSv12::handle_finished(const ByteBuffer& buffer, WritePacketStage& writ
if (on_tls_ready_to_write)
on_tls_ready_to_write(*this);
return handle_message(buffer);
return index + size;
}
void TLSv12::build_random(PacketBuilder& builder)

8
Libraries/LibTLS/Record.cpp
View file

@ -233,11 +233,13 @@ ssize_t TLSv12::handle_message(const ByteBuffer& buffer)
return (i8)Error::BrokenPacket;
}
const u8* message_hmac = decrypted_span.offset(length - mac_size);
length -= mac_size;
const u8* message_hmac = decrypted_span.offset(length);
u8 temp_buf[5];
memcpy(temp_buf, buffer.offset_pointer(0), 3);
*(u16*)(temp_buf + 3) = convert_between_host_and_network(length);
auto hmac = hmac_message({ temp_buf, 5 }, decrypted_span, mac_size);
auto hmac = hmac_message({ temp_buf, 5 }, decrypted_span.slice(0, length), mac_size);
auto message_mac = ByteBuffer::wrap(const_cast<u8*>(message_hmac), mac_size);
if (hmac != message_mac) {
dbg() << "integrity check failed (mac length " << length << ")";
@ -250,7 +252,7 @@ ssize_t TLSv12::handle_message(const ByteBuffer& buffer)
return (i8)Error::IntegrityCheckFailed;
}
plain = decrypted.slice(0, length - mac_size);
plain = decrypted.slice(0, length);
}
m_context.remote_sequence_number++;