Skip to content

Commit 0608db4

Browse files
committed
Fix MAC Algo Match
1. Rearrange the matching of the MAC Algos when decoding the KEX Init message. It should only dereference the handshake info to check if it is using an AEAD cipher if ret is WS_SUCCESS. (If the handshake info isn't present, there will be an error present.) This prevents a possible NULL dereference.
1 parent 01c1aad commit 0608db4

1 file changed

Lines changed: 13 additions & 16 deletions

File tree

src/internal.c

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3978,15 +3978,14 @@ static int DoKexInit(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
39783978
listSz = (word32)sizeof(list);
39793979
ret = GetNameList(list, &listSz, buf, len, &begin);
39803980
}
3981-
if (!ssh->handshake->aeadMode) {
3982-
if (ret == WS_SUCCESS) {
3983-
cannedAlgoNamesSz = AlgoListSz(ssh->algoListMac);
3984-
cannedListSz = (word32)sizeof(cannedList);
3985-
ret = GetNameListRaw(cannedList, &cannedListSz,
3986-
(const byte*)ssh->algoListMac, cannedAlgoNamesSz);
3987-
}
3981+
if (ret == WS_SUCCESS && !ssh->handshake->aeadMode) {
3982+
cannedAlgoNamesSz = AlgoListSz(ssh->algoListMac);
3983+
cannedListSz = (word32)sizeof(cannedList);
3984+
ret = GetNameListRaw(cannedList, &cannedListSz,
3985+
(const byte*)ssh->algoListMac, cannedAlgoNamesSz);
39883986
if (ret == WS_SUCCESS) {
3989-
algoId = MatchIdLists(side, list, listSz, cannedList, cannedListSz);
3987+
algoId = MatchIdLists(side, list, listSz,
3988+
cannedList, cannedListSz);
39903989
if (algoId == ID_UNKNOWN) {
39913990
WLOG(WS_LOG_DEBUG, "Unable to negotiate MAC Algo C2S");
39923991
ret = WS_MATCH_MAC_ALGO_E;
@@ -4000,15 +3999,13 @@ static int DoKexInit(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
40003999
listSz = (word32)sizeof(list);
40014000
ret = GetNameList(list, &listSz, buf, len, &begin);
40024001
}
4003-
if (!ssh->handshake->aeadMode) {
4004-
if (ret == WS_SUCCESS) {
4005-
algoId = MatchIdLists(side, list, listSz, &algoId, 1);
4006-
if (algoId == ID_UNKNOWN) {
4007-
WLOG(WS_LOG_DEBUG, "Unable to negotiate MAC Algo S2C");
4008-
ret = WS_MATCH_MAC_ALGO_E;
4009-
}
4002+
if (ret == WS_SUCCESS && !ssh->handshake->aeadMode) {
4003+
algoId = MatchIdLists(side, list, listSz, &algoId, 1);
4004+
if (algoId == ID_UNKNOWN) {
4005+
WLOG(WS_LOG_DEBUG, "Unable to negotiate MAC Algo S2C");
4006+
ret = WS_MATCH_MAC_ALGO_E;
40104007
}
4011-
if (ret == WS_SUCCESS) {
4008+
else {
40124009
ssh->handshake->macId = algoId;
40134010
ssh->handshake->macSz = MacSzForId(algoId);
40144011
ssh->handshake->keys.macKeySz =

0 commit comments

Comments
 (0)