Merge pull request #135 from CESNET/tls-sni-parser-fix

hynekkar · web-flow · commit 64b4c30981e1 · 2023-02-03T08:57:44.000+01:00
Tls - fix buffer overflow when parsing TLS SNI field
diff --git a/process/tls_parser.cpp b/process/tls_parser.cpp
@@ -119,7 +119,7 @@ void TLSParser::tls_get_server_name(TLSData &data, char *buffer, size_t buffer_s
       memcpy(buffer + buff_offset, data.start + offset, sni_len);
 
       buff_offset += sni_len + 1;
-      buffer[sni_len + buff_offset] = 0;
+      buffer[buff_offset - 1] = 0;
       data.obejcts_parsed++;
       offset += ntohs(tmp_sni->length);
    }

Original file line number	Diff line number	Diff line change
`@@ -119,7 +119,7 @@ void TLSParser::tls_get_server_name(TLSData &data, char *buffer, size_t buffer_s`
`119`	`119`	`memcpy(buffer + buff_offset, data.start + offset, sni_len);`
`120`	`120`
`121`	`121`	`buff_offset += sni_len + 1;`
`122`		`- buffer[sni_len + buff_offset] = 0;`
	`122`	`+ buffer[buff_offset - 1] = 0;`
`123`	`123`	`data.obejcts_parsed++;`
`124`	`124`	`offset += ntohs(tmp_sni->length);`
`125`	`125`	`}`