commit 0f31ac75667b2304fb109da1dfd8a38e5bf89e1d
author David Benjamin <davidben@google.com> Wed Nov 02 23:05:14 2016 -0400
committer Adam Langley <agl@google.com> Tue Nov 08 22:57:21 2016 +0000
tree d6062d8d92839129adc52d1f9cac208c8ab57b49
parent 11a7b3c2d902ddb039e42fe19933e2a942f585f0

Don't serialize negative times and timeouts.

The values are long, so check for negative numbers.

Change-Id: I8fc7333edbed50dc058547a4b53bc10b234071b4
Reviewed-on: https://boringssl-review.googlesource.com/12100
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>

ssl/ssl_asn1.c

diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index f81450b..f1f4da6 100644
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -197,6 +197,11 @@
   }
 
   if (in->time != 0) {
+    if (in->time < 0) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+      goto err;
+    }
+
     if (!CBB_add_asn1(&session, &child, kTimeTag) ||
         !CBB_add_asn1_uint64(&child, in->time)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
@@ -205,6 +210,11 @@
   }
 
   if (in->timeout != 0) {
+    if (in->timeout < 0) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+      goto err;
+    }
+
     if (!CBB_add_asn1(&session, &child, kTimeoutTag) ||
         !CBB_add_asn1_uint64(&child, in->timeout)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);