From 3ff7f6be9bb08463dd06765ab501430c4965ee05 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Fri, 17 Apr 2026 17:49:31 +0200 Subject: [PATCH 2/8] buffers: shorten merge_handshake_packet using recv_buf I had vague concerns about thread-safety of this, but then this pattern already exists within the file. Signed-off-by: Alexander Sosedkin Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0] CVE: CVE-2026-33846 Signed-off-by: Pritam Srichandan Sahoo --- lib/buffers.c | 52 +++++++++++++++++---------------------------------- 1 file changed, 17 insertions(+), 35 deletions(-) diff --git a/lib/buffers.c b/lib/buffers.c index 672380b05..d54c77022 100644 --- a/lib/buffers.c +++ b/lib/buffers.c @@ -967,9 +967,11 @@ static int merge_handshake_packet(gnutls_session_t session, int exists = 0, i, pos = 0; int ret; + handshake_buffer_st *recv_buf = + session->internals.handshake_recv_buffer; + for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) { - if (session->internals.handshake_recv_buffer[i].htype == - hsk->htype) { + if (recv_buf[i].htype == hsk->htype) { exists = 1; pos = i; break; @@ -1005,44 +1007,24 @@ static int merge_handshake_packet(gnutls_session_t session, _gnutls_write_uint24(0, &hsk->header[6]); _gnutls_write_uint24(hsk->length, &hsk->header[9]); - _gnutls_handshake_buffer_move( - &session->internals.handshake_recv_buffer[pos], hsk); + _gnutls_handshake_buffer_move(&recv_buf[pos], hsk); } else { - if (hsk->start_offset < - session->internals.handshake_recv_buffer[pos] - .start_offset && - hsk->end_offset + 1 >= - session->internals.handshake_recv_buffer[pos] - .start_offset) { - memcpy(&session->internals.handshake_recv_buffer[pos] - .data.data[hsk->start_offset], + if (hsk->start_offset < recv_buf[pos].start_offset && + hsk->end_offset + 1 >= recv_buf[pos].start_offset) { + memcpy(&recv_buf[pos].data.data[hsk->start_offset], hsk->data.data, hsk->data.length); - session->internals.handshake_recv_buffer[pos] - .start_offset = hsk->start_offset; - session->internals.handshake_recv_buffer[pos] - .end_offset = MIN( - hsk->end_offset, - session->internals.handshake_recv_buffer[pos] - .end_offset); - } else if (hsk->end_offset > - session->internals.handshake_recv_buffer[pos] - .end_offset && - hsk->start_offset <= - session->internals.handshake_recv_buffer[pos] - .end_offset + - 1) { - memcpy(&session->internals.handshake_recv_buffer[pos] - .data.data[hsk->start_offset], + recv_buf[pos].start_offset = hsk->start_offset; + recv_buf[pos].end_offset = + MIN(hsk->end_offset, recv_buf[pos].end_offset); + } else if (hsk->end_offset > recv_buf[pos].end_offset && + hsk->start_offset <= recv_buf[pos].end_offset + 1) { + memcpy(&recv_buf[pos].data.data[hsk->start_offset], hsk->data.data, hsk->data.length); - session->internals.handshake_recv_buffer[pos] - .end_offset = hsk->end_offset; - session->internals.handshake_recv_buffer[pos] - .start_offset = MIN( - hsk->start_offset, - session->internals.handshake_recv_buffer[pos] - .start_offset); + recv_buf[pos].end_offset = hsk->end_offset; + recv_buf[pos].start_offset = MIN( + hsk->start_offset, recv_buf[pos].start_offset); } _gnutls_handshake_buffer_clear(hsk); } -- 2.53.0