Fix TLSX_EchChangeSNI to check hostname termination#10182
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR addresses a crash/overflow risk in ECH SNI handling by ensuring truncated hostnames are NUL-terminated, and adds a regression test to prevent reintroducing the issue.
Changes:
- Ensure the hostname buffer is NUL-terminated when truncating in
TLSX_EchChangeSNI. - Add a regression test that uses an overlong inner SNI hostname to exercise truncation and confirm no crash.
- Register the new test in the API test suite.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/tls.c |
Adds NUL termination to the truncated SNI hostname buffer to prevent out-of-bounds reads in TLSX_EchRestoreSNI. |
tests/api.c |
Adds and registers a regression test that sets an overlong SNI to exercise the truncation path during ECH handshake. |
Comments suppressed due to low confidence (1)
tests/api.c:1
- The PR description’s “Testing” section says “Added
TLSX_EchChangeSNI”, but the actual addition is a regression testtest_wolfSSL_Tls13_ECH_long_SNI. Please update the PR description to reflect the real test name (and/or what test coverage was added) so it’s easier to track in CI and future triage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #10182
Scan targets checked: wolfssl-bugs, wolfssl-compliance, wolfssl-consttime, wolfssl-defaults, wolfssl-mutation, wolfssl-proptest, wolfssl-src, wolfssl-zeroize
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
|
Jenkins retest this please |
…0182): * Fix OOB heap reads via TLSX_ExtractEch() by preemptively rejecting oversized SNI names in TLSX_UseSNI(). * In TLSX_EchChangeSNI(), don't attempt to truncate if an oversized name is seen, just return error. * Move definition of WOLFSSL_HOST_NAME_MAX to an ungated context in ssl.h, and use it consistently in tls.c, eliminating the duplicative WOLFSSL_HOST_NAME_MAX.
Description
Add NUL to terminate hostname string
Fixes zd21576
Testing
Added
TLSX_EchChangeSNIChecklist