fix ignored clearold flag #20197
Description
Wanted to notify about this bug in OpenSSL, I stumbled upon it during development of vpp static server https POST that uses crypto engine + pipeline support.
I failed to get the git push working, so I am posting the commit that fixes the bug I experienced.
From ea7e8b0f6123846d143d0a6132b47c62a931db5e Mon Sep 17 00:00:00 2001
From: Ofer Heifetz <oferh@marvell.com>
Date: Tue, 24 Jan 2023 12:16:33 -0800
Subject: [PATCH] fix ignored clearold flag
When ssl3_read_n() is called with clearold == 1, packet data should
be moved to start of buffer, but the routine had a memmove() call
regardless to clearold value.
On a system that is configured to use piplines, the above flag ignorance
may cause situation where two records use the same address.
Signed-off-by: Ofer Heifetz <oferh@marvell.com>
---
ssl/record/rec_layer_s3.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c
index 1db1712a09..58e0066dee 100644
--- a/ssl/record/rec_layer_s3.c
+++ b/ssl/record/rec_layer_s3.c
@@ -230,8 +230,10 @@ int ssl3_read_n(SSL *s, size_t n, size_t max, int extend, int clearold,
* effect on memmove arguments and therefore no buffer
* overrun can be triggered.
*/
- memmove(rb->buf + align, pkt, left);
- rb->offset = align;
+ if (clearold == 1) {
+ memmove(rb->buf + align, pkt, left);
+ rb->offset = align;
+ }
}
}
s->rlayer.packet = rb->buf + rb->offset;
--
2.25.1