usa	2015-10-29 23:07:59 +0900 (Thu, 29 Oct 2015)

  New Revision: 52356

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=52356

  Log:
    merge revision(s) 52227,52228: [Backport #11369]
    
    * ext/openssl/ossl_ssl.c (ssl_npn_select_cb): explicitly raise error
      in ext/openssl instead of OpenSSL itself because LibreSSL
      silently truncate the selected protocol name by casting the length
      from int to unsigned char. [Bug #11369]
      Patch by Jeremy Evans <merch-redmine@j...>

  Modified directories:
    branches/ruby_2_1/
  Modified files:
    branches/ruby_2_1/ChangeLog
    branches/ruby_2_1/ext/openssl/ossl_ssl.c
    branches/ruby_2_1/version.h
Index: ruby_2_1/ChangeLog
===================================================================
--- ruby_2_1/ChangeLog	(revision 52355)
+++ ruby_2_1/ChangeLog	(revision 52356)
@@ -1,3 +1,11 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_1/ChangeLog#L1
+Thu Oct 29 23:04:04 2015  NARUSE, Yui  <naruse@r...>
+
+	* ext/openssl/ossl_ssl.c (ssl_npn_select_cb): explicitly raise error
+	  in ext/openssl instead of OpenSSL itself because LibreSSL
+	  silently truncate the selected protocol name by casting the length
+	  from int to unsigned char. [Bug #11369]
+	  Patch by Jeremy Evans <merch-redmine@j...>
+
 Thu Oct 29 22:56:01 2015  Nobuyoshi Nakada  <nobu@r...>
 
 	* configure.in: check for libunwind.h, which is not available in
Index: ruby_2_1/ext/openssl/ossl_ssl.c
===================================================================
--- ruby_2_1/ext/openssl/ossl_ssl.c	(revision 52355)
+++ ruby_2_1/ext/openssl/ossl_ssl.c	(revision 52356)
@@ -606,29 +606,47 @@ ssl_npn_advertise_cb(SSL *ssl, const uns https://github.com/ruby/ruby/blob/trunk/ruby_2_1/ext/openssl/ossl_ssl.c#L606
 }
 
 static int
-ssl_npn_select_cb(SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
+ssl_npn_select_cb_common(VALUE cb, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen)
 {
-    int i = 0;
-    VALUE sslctx_obj, cb, protocols, selected;
-
-    sslctx_obj = (VALUE) arg;
-    cb = rb_iv_get(sslctx_obj, "@npn_select_cb");
-    protocols = rb_ary_new();
+    VALUE selected;
+    long len;
+    unsigned char l;
+    VALUE protocols = rb_ary_new();
 
     /* The format is len_1|proto_1|...|len_n|proto_n\0 */
-    while (in[i]) {
-	VALUE protocol = rb_str_new((const char *) &in[i + 1], in[i]);
+    while (l = *in++) {
+	VALUE protocol;
+	if (l > inlen) {
+	    ossl_raise(eSSLError, "Invalid protocol name list");
+	}
+	protocol = rb_str_new((const char *)in, l);
 	rb_ary_push(protocols, protocol);
-	i += in[i] + 1;
+	in += l;
+	inlen -= l;
     }
 
     selected = rb_funcall(cb, rb_intern("call"), 1, protocols);
     StringValue(selected);
-    *out = (unsigned char *) StringValuePtr(selected);
-    *outlen = RSTRING_LENINT(selected);
+    len = RSTRING_LEN(selected);
+    if (len < 1 || len >= 256) {
+	ossl_raise(eSSLError, "Selected protocol name must have length 1..255");
+    }
+    *out = (unsigned char *)RSTRING_PTR(selected);
+    *outlen = (unsigned char)len;
 
     return SSL_TLSEXT_ERR_OK;
 }
+
+static int
+ssl_npn_select_cb(SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
+{
+    VALUE sslctx_obj, cb;
+
+    sslctx_obj = (VALUE) arg;
+    cb = rb_iv_get(sslctx_obj, "@npn_select_cb");
+
+    return ssl_npn_select_cb_common(cb, (const unsigned char **)out, outlen, in, inlen);
+}
 #endif
 
 /* This function may serve as the entry point to support further
Index: ruby_2_1/version.h
===================================================================
--- ruby_2_1/version.h	(revision 52355)
+++ ruby_2_1/version.h	(revision 52356)
@@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_1/version.h#L1
 #define RUBY_VERSION "2.1.8"
 #define RUBY_RELEASE_DATE "2015-10-29"
-#define RUBY_PATCHLEVEL 407
+#define RUBY_PATCHLEVEL 408
 
 #define RUBY_RELEASE_YEAR 2015
 #define RUBY_RELEASE_MONTH 10

Property changes on: ruby_2_1
___________________________________________________________________
Modified: svn:mergeinfo
   Merged /trunk:r52227-52228


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/