1642638 - nss:tls-server: ASSERT: PR_FALSE, at ../../lib/ssl/ssl3con.c:640

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Kevin Jacobs [:kjacobs]]

OSS-Fuzz had found an assertion crash: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22960

On first glance it looks like the assertion just needs to be relaxed, since the server is checking data written by itself, but I haven't done a thorough analysis.

To reproduce build nss with ./build.sh --fuzz=tls --asan and run LD_LIBRARY_PATH=../dist/Debug/lib/ nssfuzz-tls-server testcase.

Reported-2020-06-02
Disclosure ~2020-08-31

Comment 1

[Kevin Jacobs [:kjacobs]]

Confirmed there is no security impact. The fuzzer is using an undefined value for the sid's ciphersuite. This is not unexpected since the tickets are unencrypted and unprotected in fuzzer mode. Ifdef'ing the assertions causes the testcase to complete (fail) normally.

Comment 2

[Kevin Jacobs [:kjacobs]]

Attachment: Bug 1642638 - Don't assert sid ciphersuite to be defined in fuzzer mode.

Comment 3

[Kevin Jacobs [:kjacobs]]

https://hg.mozilla.org/projects/nss/rev/238bd7912429145d5f3ec2442fb61bb0b5602dfc