@@ -28121,6 +28121,8 @@ static int test_ticket_enc_corrupted(void)
2812128121 WOLFSSL_SESSION* sess = NULL;
2812228122 ExternalTicket* et;
2812328123 word16 encLen;
28124+ int actualEncLen;
28125+ int craftedBadLen = 0;
2812428126
2812528127 XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2812628128 ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
@@ -28133,12 +28135,21 @@ static int test_ticket_enc_corrupted(void)
2813328135 if (sess != NULL) {
2813428136 ExpectIntGT(sess->ticketLen, WOLFSSL_TICKET_FIXED_SZ);
2813528137
28136- /* Force enc_len to exceed actual encrypted ticket payload */
28138+ /* Force enc_len to exceed actual encrypted ticket payload while still
28139+ * staying <= WOLFSSL_TICKET_ENC_SZ, so callback is reached. */
2813728140 et = (ExternalTicket*)sess->ticket;
2813828141 ato16(et->enc_len, &encLen);
28139- encLen = (word16)(sess->ticketLen - WOLFSSL_TICKET_FIXED_SZ + 100);
28140- ExpectIntLE((int)encLen, (int)WOLFSSL_TICKET_ENC_SZ);
28141- c16toa(encLen, et->enc_len);
28142+ actualEncLen = (int)(sess->ticketLen - WOLFSSL_TICKET_FIXED_SZ);
28143+ if (actualEncLen + 100 <= (int)WOLFSSL_TICKET_ENC_SZ) {
28144+ encLen = (word16)(actualEncLen + 100);
28145+ c16toa(encLen, et->enc_len);
28146+ craftedBadLen = 1;
28147+ }
28148+ else if (actualEncLen + 1 <= (int)WOLFSSL_TICKET_ENC_SZ) {
28149+ encLen = (word16)(actualEncLen + 1);
28150+ c16toa(encLen, et->enc_len);
28151+ craftedBadLen = 1;
28152+ }
2814228153 }
2814328154
2814428155 wolfSSL_free(ssl_c);
@@ -28157,6 +28168,14 @@ static int test_ticket_enc_corrupted(void)
2815728168 wolfSSL_set_verify(ssl_s, WOLFSSL_VERIFY_NONE, 0);
2815828169 wolfSSL_set_verify(ssl_c, WOLFSSL_VERIFY_NONE, 0);
2815928170 if (sess != NULL) {
28171+ if (!craftedBadLen) {
28172+ wolfSSL_SESSION_free(sess);
28173+ wolfSSL_free(ssl_c);
28174+ wolfSSL_free(ssl_s);
28175+ wolfSSL_CTX_free(ctx_c);
28176+ wolfSSL_CTX_free(ctx_s);
28177+ return TEST_SKIPPED;
28178+ }
2816028179 ExpectIntEQ(wolfSSL_set_session(ssl_c, sess), WOLFSSL_SUCCESS);
2816128180 ExpectIntEQ(wolfSSL_CTX_set_TicketEncCb(ctx_s,
2816228181 test_ticket_enc_corrupted_cb), WOLFSSL_SUCCESS);
0 commit comments