From: Joseph Jones Date: 2015-12-17T21:13:26-07:00 Subject: [ruby-core:72345] [Ruby trunk - Bug #11810] [Open] [PATCH] OpenSSL::SSL::SSLcontext#{alpn, npn}_select_cb= does not work properly --567387e6_45e6d486_16c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Joseph Jones liked your message with Boxer. On December 12, 2015 at 10:34= :39 MST, k=40rhe.jp wrote:Issue =2311810 has been reported by Kazuki Yama= guchi.----------------------------------------Bug =2311810: =5BPATCH=5D O= penSSL::SSL::SSLcontext=23=7Balpn,npn=7D=5Fselect=5Fcb=3D does not work p= roperlyhttps://bugs.ruby-lang.org/issues/11810* Author: Kazuki Yamaguchi*= Status: Open* Priority: Normal* Assignee: * ruby -v: ruby 2.3.0dev (2015= -12-13 trunk 53061) =5Bx86=5F64-linux=5D* Backport: 2.0.0: UNKNOWN, 2.1: = UNKNOWN, 2.2: UNKNOWN----------------------------------------The protocol= list passed to the callback function (set by =60SSL=5FCTX=5Fset=5Falpn=5F= select=5Fcb=60, =60SSL=5FCTX=5Fset=5Fnext=5Fproto=5Fselect=5Fcb=60) is no= t null-terminated string.This issue seems to have been existing since fir= st NPN was supported (r36871).This patch also removes the code checking t= he length of protocol name, because it is already validated by OpenSSL.--= -=46iles--------------------------------0001-ext-openssl-ossl=5Fssl.c-ssl= =5Fnpn=5Fselect=5Fcb=5Fcommon-fix-.patch (1.27 KB)-- https://bugs.ruby-la= ng.org/ --567387e6_45e6d486_16c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Joseph Jones liked your message with Boxer.


= On December 12, 2015 at 10:34:39 MST, k=40rhe.jp wrote:
Issue =2311810 has been reported by Kaz= uki Yamaguchi.

----------------------------------------
B= ug =2311810: =5BPATCH=5D OpenSSL::SSL::SSLcontext=23=7Balpn,npn=7D=5Fsele= ct=5Fcb=3D does not work properly
https://bugs.ruby-lang.org/issues/= 11810

* Author: Kazuki Yamaguchi
* Status: Open
* Pr= iority: Normal
* Assignee:
* ruby -v: ruby 2.3.0dev (2015-12-1= 3 trunk 53061) =5Bx86=5F64-linux=5D
* Backport: 2.0.0: UNKNOWN, 2.1:= UNKNOWN, 2.2: UNKNOWN
----------------------------------------
The protocol list passed to the callback function (set by =60SSL=5FCTX=5F= set=5Falpn=5Fselect=5Fcb=60, =60SSL=5FCTX=5Fset=5Fnext=5Fproto=5Fselect=5F= cb=60) is not null-terminated string.
This issue seems to have been = existing since first NPN was supported (r36871).

This patch al= so removes the code checking the length of protocol name, because it is a= lready validated by OpenSSL.

---=46iles-----------------------= ---------
0001-ext-openssl-ossl=5Fssl.c-ssl=5Fnpn=5Fselect=5Fcb=5Fco= mmon-fix-.patch (1.27 KB)


--
https://bugs.ruby-lan= g.org/
--567387e6_45e6d486_16c--