commit 8e205fc0bcd4533b91bd04c62a22d4d992a0e6da
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Thu Jan 23 17:27:10 2014 +0100
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Thu Jan 23 17:27:10 2014 +0100
tree d6f35eaf05ecceb344ec81229784fc67cd0c71ef
parent 8505d50d4b93e9c576940f917e067c030d406a3f

Fix potential buffer overflow in suported_curves_ext

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 76c943d..62df857 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -231,7 +231,7 @@
                                                      size_t *olen )
 {
     unsigned char *p = buf;
-    unsigned char elliptic_curve_list[20];
+    unsigned char *elliptic_curve_list = p + 6;
     size_t elliptic_curve_len = 0;
     const ecp_curve_info *curve;
     ((void) ssl);
@@ -260,8 +260,6 @@
     *p++ = (unsigned char)( ( ( elliptic_curve_len     ) >> 8 ) & 0xFF );
     *p++ = (unsigned char)( ( ( elliptic_curve_len     )      ) & 0xFF );
 
-    memcpy( p, elliptic_curve_list, elliptic_curve_len );
-
     *olen = 6 + elliptic_curve_len;
 }