Convert session_id_length and sid_ctx_len to size_t
Reviewed-by: Rich Salz <rsalz@openssl.org>
diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index aa6e3e6..9b6ea0a 100644
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -223,14 +223,14 @@
/* Copy an OCTET STRING, return error if it exceeds maximum length */
-static int ssl_session_memcpy(unsigned char *dst, unsigned int *pdstlen,
- ASN1_OCTET_STRING *src, int maxlen)
+static int ssl_session_memcpy(unsigned char *dst, size_t *pdstlen,
+ ASN1_OCTET_STRING *src, size_t maxlen)
{
if (src == NULL) {
*pdstlen = 0;
return 1;
}
- if (src->length > maxlen)
+ if (src->length < 0 || src->length > (int)maxlen)
return 0;
memcpy(dst, src->data, src->length);
*pdstlen = src->length;
@@ -241,7 +241,7 @@
long length)
{
long id;
- unsigned int tmpl;
+ size_t tmpl;
const unsigned char *p = *pp;
SSL_SESSION_ASN1 *as = NULL;
SSL_SESSION *ret = NULL;
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 6388d10..651dfa5 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -503,14 +503,14 @@
size_t master_key_length;
unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
/* session_id - valid? */
- unsigned int session_id_length;
+ size_t session_id_length;
unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
/*
* this is used to determine whether the session is being reused in the
* appropriate context. It is up to the application to set this, via
* SSL_new
*/
- unsigned int sid_ctx_length;
+ size_t sid_ctx_length;
unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
# ifndef OPENSSL_NO_PSK
char *psk_identity_hint;
@@ -722,7 +722,7 @@
void *msg_callback_arg;
uint32_t verify_mode;
- unsigned int sid_ctx_length;
+ size_t sid_ctx_length;
unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
/* called 'verify_callback' in the SSL */
int (*default_verify_callback) (int ok, X509_STORE_CTX *ctx);
@@ -958,7 +958,7 @@
* the session_id_context is used to ensure sessions are only reused in
* the appropriate context
*/
- unsigned int sid_ctx_length;
+ size_t sid_ctx_length;
unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
/* This can also be in the session once a session is established */
SSL_SESSION *session;
diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
index dbbf9d9..a7faf48 100644
--- a/ssl/ssl_txt.c
+++ b/ssl/ssl_txt.c
@@ -57,7 +57,7 @@
int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
{
- unsigned int i;
+ size_t i;
const char *s;
if (x == NULL)
@@ -98,7 +98,7 @@
}
if (BIO_puts(bp, "\n Master-Key: ") <= 0)
goto err;
- for (i = 0; i < (unsigned int)x->master_key_length; i++) {
+ for (i = 0; i < x->master_key_length; i++) {
if (BIO_printf(bp, "%02X", x->master_key[i]) <= 0)
goto err;
}
@@ -181,7 +181,7 @@
*/
int SSL_SESSION_print_keylog(BIO *bp, const SSL_SESSION *x)
{
- unsigned int i;
+ size_t i;
if (x == NULL)
goto err;
@@ -204,7 +204,7 @@
}
if (BIO_puts(bp, " Master-Key:") <= 0)
goto err;
- for (i = 0; i < (unsigned int)x->master_key_length; i++) {
+ for (i = 0; i < x->master_key_length; i++) {
if (BIO_printf(bp, "%02X", x->master_key[i]) <= 0)
goto err;
}
diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
index c6b025c..3129456 100644
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -696,8 +696,8 @@
int tls_construct_client_hello(SSL *s, WPACKET *pkt)
{
unsigned char *p;
- int i;
- int protverr;
+ size_t sess_id_len;
+ int i, protverr;
int al = SSL_AD_HANDSHAKE_FAILURE;
#ifndef OPENSSL_NO_COMP
SSL_COMP *comp;
@@ -788,12 +788,13 @@
/* Session ID */
if (s->new_session)
- i = 0;
+ sess_id_len = 0;
else
- i = s->session->session_id_length;
- if (i > (int)sizeof(s->session->session_id)
+ sess_id_len = s->session->session_id_length;
+ if (sess_id_len > sizeof(s->session->session_id)
|| !WPACKET_start_sub_packet_u8(pkt)
- || (i != 0 && !WPACKET_memcpy(pkt, s->session->session_id, i))
+ || (sess_id_len != 0 && !WPACKET_memcpy(pkt, s->session->session_id,
+ sess_id_len))
|| !WPACKET_close(pkt)) {
SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
return 0;
@@ -1880,6 +1881,7 @@
int al;
unsigned int ticklen;
unsigned long ticket_lifetime_hint;
+ unsigned int sess_len;
if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint)
|| !PACKET_get_net_2(pkt, &ticklen)
@@ -1944,12 +1946,17 @@
* elsewhere in OpenSSL. The session ID is set to the SHA256 (or SHA1 is
* SHA256 is disabled) hash of the ticket.
*/
+ /*
+ * TODO(size_t): we use sess_len here because EVP_Digest expects an int
+ * but s->session->session_id_length is a size_t
+ */
if (!EVP_Digest(s->session->tlsext_tick, ticklen,
- s->session->session_id, &s->session->session_id_length,
+ s->session->session_id, &sess_len,
EVP_sha256(), NULL)) {
SSLerr(SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_EVP_LIB);
goto err;
}
+ s->session->session_id_length = sess_len;
return MSG_PROCESS_CONTINUE_READING;
f_err:
ssl3_send_alert(s, SSL3_AL_FATAL, al);
diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index f936588..8530205 100644
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -1491,8 +1491,8 @@
int tls_construct_server_hello(SSL *s, WPACKET *pkt)
{
- int sl, compm, al = SSL_AD_INTERNAL_ERROR;
- size_t len;
+ int compm, al = SSL_AD_INTERNAL_ERROR;
+ size_t sl, len;
if (!WPACKET_put_bytes_u16(pkt, s->version)
/*
@@ -1526,7 +1526,7 @@
s->session->session_id_length = 0;
sl = s->session->session_id_length;
- if (sl > (int)sizeof(s->session->session_id)) {
+ if (sl > sizeof(s->session->session_id)) {
SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
goto err;
}
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index e19f93d..3918caf 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -21,7 +21,7 @@
#include <openssl/ct.h>
static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
- const unsigned char *sess_id, int sesslen,
+ const unsigned char *sess_id, size_t sesslen,
SSL_SESSION **psess);
static int ssl_check_clienthello_tlsext_early(SSL *s);
static int ssl_check_serverhello_tlsext(SSL *s);
@@ -2964,7 +2964,7 @@
*/
static int tls_decrypt_ticket(SSL *s, const unsigned char *etick,
int eticklen, const unsigned char *sess_id,
- int sesslen, SSL_SESSION **psess)
+ size_t sesslen, SSL_SESSION **psess)
{
SSL_SESSION *sess;
unsigned char *sdec;
