1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

crypto: handle i2d_SSL_SESSION() error return

Browse Source 
i2d_SSL_SESSION() can return a value <= 0 when the session is malformed
or otherwise invalid. Handle that case.

This change comes without a regression test because I couldn't figure
out a good way to generate an existing but invalid session in a timely
fashion.

Fixes: https://github.com/nodejs/node/issues/29202

PR-URL: https://github.com/nodejs/node/pull/29225
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
This commit is contained in:
Ben Noordhuis 2019-08-20 14:10:42 +02:00 committed by Rich Trott
parent 6726f567d7
commit ceace1f96e
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/node_crypto.cc
View File

@ -2317,11 +2317,12 @@ void SSLWrap<Base>::GetSession(const FunctionCallbackInfo<Value>& args) {
return;
int slen = i2d_SSL_SESSION(sess, nullptr);
CHECK_GT(slen, 0);
if (slen <= 0)
return; // Invalid or malformed session.
AllocatedBuffer sbuf = env->AllocateManaged(slen);
unsigned char* p = reinterpret_cast<unsigned char*>(sbuf.data());
i2d_SSL_SESSION(sess, &p);
CHECK_LT(0, i2d_SSL_SESSION(sess, &p));
args.GetReturnValue().Set(sbuf.ToBuffer().ToLocalChecked());
}