Fixed bug in handling incoming records with invalid length (impacted CBC encryption...

Bug was reported by Thai Duong at Calif.io (with some AI stuff from Anthropic Research).

diff --git a/src/ssl/ssl_rec_cbc.c b/src/ssl/ssl_rec_cbc.c
index c38cbfd..9e89bb6 100644 (file)
--- a/src/ssl/ssl_rec_cbc.c
+++ b/src/ssl/ssl_rec_cbc.c
@@ -70,7 +70,7 @@ cbc_check_length(const br_sslrec_in_cbc_context *cc, size_t rlen)
                min_len += blen;
                max_len += blen;
        }
-       return min_len <= rlen && rlen <= max_len;
+       return min_len <= rlen && rlen <= max_len && (rlen & (blen - 1)) == 0;
 }
 
 /*