Fix buffer-overrun bug in net (#17728) [backport:1.0]

(cherry picked from commit fdd4391)
nim-lang · Aug 24, 2021 · e5a3f30 · e5a3f30
1 parent 286b94e
commit e5a3f30
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/changelog.md b/changelog.md
@@ -17,6 +17,9 @@
 
 
 ## Library additions
+- Fixed buffer overflow bugs in `net`
+
+- Added `sections` iterator in `parsecfg`.
 
 - Added `browsers.osOpen` const alias for the operating system specific *"open"* command.
 

diff --git a/lib/pure/net.nim b/lib/pure/net.nim
@@ -598,12 +598,11 @@ when defineSsl:
     let ctx = SslContext(context: ssl.SSL_get_SSL_CTX)
     let hintString = if hint == nil: "" else: $hint
     let (identityString, pskString) = (ctx.clientGetPskFunc)(hintString)
-    if psk.len.cuint > max_psk_len:
+    if pskString.len.cuint > max_psk_len:
       return 0
     if identityString.len.cuint >= max_identity_len:
       return 0
-
-    copyMem(identity, identityString.cstring, pskString.len + 1) # with the last zero byte
+    copyMem(identity, identityString.cstring, identityString.len + 1) # with the last zero byte
     copyMem(psk, pskString.cstring, pskString.len)
 
     return pskString.len.cuint
@@ -624,7 +623,7 @@ when defineSsl:
       max_psk_len: cint): cuint {.cdecl.} =
     let ctx = SslContext(context: ssl.SSL_get_SSL_CTX)
     let pskString = (ctx.serverGetPskFunc)($identity)
-    if psk.len.cint > max_psk_len:
+    if pskString.len.cint > max_psk_len:
       return 0
     copyMem(psk, pskString.cstring, pskString.len)