aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tls: JA3 buffer pointers on allocation failure

Browse Source 
Improper pointer handling would leave dangling pointers after allocation
failure that could get freed again (double free).

Ticket: #8857.
pull/16192/head
Victor Julien 1 month ago
parent 8e4d49df0d
commit 201ecd5618
1 changed files with 16 additions and 20 deletions
Show Stats Download Patch File Download Diff File

36
src/app-layer-ssl.c
Unescape Escape View File

@ -1044,9 +1044,8 @@ invalid_length:
}
static inline int TLSDecodeHSHelloExtensionEllipticCurves(SSLState *ssl_state,
const uint8_t * const initial_input,
const uint32_t input_len,
JA3Buffer *ja3_elliptic_curves)
const uint8_t *const initial_input, const uint32_t input_len,
JA3Buffer **ja3_elliptic_curves)
{
const uint8_t *input = initial_input;
@ -1063,7 +1062,8 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurves(SSLState *ssl_state,
if (!(HAS_SPACE(elliptic_curves_len)))
goto invalid_length;
if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) && ja3_elliptic_curves) {
if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) &&
*ja3_elliptic_curves != NULL) {
uint16_t ec_processed_len = 0;
/* coverity[tainted_data] */
while (ec_processed_len < elliptic_curves_len)
@ -1075,8 +1075,7 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurves(SSLState *ssl_state,
input += 2;
if (TLSDecodeValueIsGREASE(elliptic_curve) != 1) {
int rc = Ja3BufferAddValue(&ja3_elliptic_curves,
elliptic_curve);
int rc = Ja3BufferAddValue(ja3_elliptic_curves, elliptic_curve);
if (rc != 0)
return -1;
}
@ -1100,9 +1099,8 @@ invalid_length:
}
static inline int TLSDecodeHSHelloExtensionEllipticCurvePF(SSLState *ssl_state,
const uint8_t * const initial_input,
const uint32_t input_len,
JA3Buffer *ja3_elliptic_curves_pf)
const uint8_t *const initial_input, const uint32_t input_len,
JA3Buffer **ja3_elliptic_curves_pf)
{
const uint8_t *input = initial_input;
@ -1119,7 +1117,8 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurvePF(SSLState *ssl_state,
if (!(HAS_SPACE(ec_pf_len)))
goto invalid_length;
if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) && ja3_elliptic_curves_pf) {
if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) &&
*ja3_elliptic_curves_pf != NULL) {
uint8_t ec_pf_processed_len = 0;
/* coverity[tainted_data] */
while (ec_pf_processed_len < ec_pf_len)
@ -1128,8 +1127,7 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurvePF(SSLState *ssl_state,
input += 1;
if (TLSDecodeValueIsGREASE(elliptic_curve_pf) != 1) {
int rc = Ja3BufferAddValue(&ja3_elliptic_curves_pf,
elliptic_curve_pf);
int rc = Ja3BufferAddValue(ja3_elliptic_curves_pf, elliptic_curve_pf);
if (rc != 0)
return -1;
}
@ -1328,11 +1326,10 @@ static inline int TLSDecodeHSHelloExtensions(SSLState *ssl_state,
case SSL_EXTENSION_ELLIPTIC_CURVES:
{
/* coverity[tainted_data] */
ret = TLSDecodeHSHelloExtensionEllipticCurves(ssl_state, input,
ext_len,
ja3_elliptic_curves);
ret = TLSDecodeHSHelloExtensionEllipticCurves(
ssl_state, input, ext_len, &ja3_elliptic_curves);
if (ret < 0)
goto end;
goto error;
input += ext_len;
@ -1342,11 +1339,10 @@ static inline int TLSDecodeHSHelloExtensions(SSLState *ssl_state,
case SSL_EXTENSION_EC_POINT_FORMATS:
{
/* coverity[tainted_data] */
ret = TLSDecodeHSHelloExtensionEllipticCurvePF(ssl_state, input,
ext_len,
ja3_elliptic_curves_pf);
ret = TLSDecodeHSHelloExtensionEllipticCurvePF(
ssl_state, input, ext_len, &ja3_elliptic_curves_pf);
if (ret < 0)
goto end;
goto error;
input += ext_len;

Write Preview
Loading…
Cancel
Save