From 2e75513a13e3cf4a16626ef654242b3b07cc8f29 Mon Sep 17 00:00:00 2001 From: John Schanck Date: Mon, 11 Dec 2023 19:24:14 +0000 Subject: [PATCH] Bug 1867408 - add a defensive check for large ssl_DefSend return values. r=nkulatova Differential Revision: https://phabricator.services.mozilla.com/D195054 --HG-- extra : moz-landing-system : lando CVE: CVE-2024-0743 Upstream-Status: Backport [https://github.com/nss-dev/nss/commit/2e75513a13e3cf4a16626ef654242b3b07cc8f29] Signed-off-by: Peter Marko --- lib/ssl/sslsecur.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/ssl/sslsecur.c b/lib/ssl/sslsecur.c index 59ef064c9..9e994f4b5 100644 --- a/lib/ssl/sslsecur.c +++ b/lib/ssl/sslsecur.c @@ -453,7 +453,12 @@ ssl_SendSavedWriteData(sslSocket *ss) if (rv < 0) { return rv; } - ss->pendingBuf.len -= rv; + if (rv > ss->pendingBuf.len) { + PORT_Assert(0); /* This shouldn't happen */ + ss->pendingBuf.len = 0; + } else { + ss->pendingBuf.len -= rv; + } if (ss->pendingBuf.len > 0 && rv > 0) { /* UGH !! This shifts the whole buffer down by copying it */ PORT_Memmove(ss->pendingBuf.buf, ss->pendingBuf.buf + rv, -- 2.30.2