From b35e58b24c4b0ae7366d733fb36ac8bd57b73739 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Fri, 20 Feb 2026 21:41:40 +0100 Subject: [PATCH] openssl: fix potential OOB read in debug/verbose logging Reported-by: aisle-research-bot Bug: https://github.com/curl/curl/pull/20654#discussion_r2834860711 Closes #20656 --- lib/vtls/openssl.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c index ab5c1988d1..f1f8843b9a 100644 --- a/lib/vtls/openssl.c +++ b/lib/vtls/openssl.c @@ -2564,9 +2564,11 @@ static void ossl_trace(int direction, int ssl_ver, int content_type, && content_type != SSL3_RT_INNER_CONTENT_TYPE #endif ) { - const char *msg_name, *tls_rt_name; + const char *msg_name = "Truncated message"; + const char *tls_rt_name; char ssl_buf[1024]; - int msg_type, txt_len; + int msg_type = 0; + int txt_len; /* the info given when the version is zero is not that useful for us */ @@ -2582,14 +2584,18 @@ static void ossl_trace(int direction, int ssl_ver, int content_type, tls_rt_name = ""; if(content_type == SSL3_RT_CHANGE_CIPHER_SPEC) { - msg_type = *(const char *)buf; - msg_name = "Change cipher spec"; + if(len) { + msg_type = *(const char *)buf; + msg_name = "Change cipher spec"; + } } else if(content_type == SSL3_RT_ALERT) { - msg_type = (((const char *)buf)[0] << 8) + ((const char *)buf)[1]; - msg_name = SSL_alert_desc_string_long(msg_type); + if(len >= 2) { + msg_type = (((const char *)buf)[0] << 8) + ((const char *)buf)[1]; + msg_name = SSL_alert_desc_string_long(msg_type); + } } - else { + else if(len) { msg_type = *(const char *)buf; msg_name = ssl_msg_type(ssl_ver, msg_type); }