1986352 - Assertion failure: tmpEchInner, at ../../lib/ssl/tls13ech.c:2359

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[Maurice Dauer [:mdauer]]

Attachment: clusterfuzz-testcase-minimized-tls-server-5304540506423296

OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5304540506423296

Details

The assertion was added in a10493dcfcc92cb9bad985b151325238b6e38b09 as part of Bug 1654332. If tmpEchInner is NULL, it will lead to a null pointer dereference later on:

        PORT_Assert(tmpEchInner);
        PORT_Assert(!PR_CLIST_IS_EMPTY(&ss->ssl3.hs.remoteExtensions));

        /* Start over on ECHInner */
        b = tmpEchInner->data;
        length = tmpEchInner->len;
        rv = ssl3_HandleClientHelloPreamble(ss, &b, &length, &tmpSid,
                                            &tmpCookie, &tmpSuites, &tmpComps);
        if (rv != SECSuccess) {
            goto loser; /* code set, alert sent. */
        }

Note that this was found with UNSAFE_FUZZER_MODE enabled.

---

To reproduce, perform the following steps:

1. Build NSS with ./build.sh -c --fuzz=tls --disable-tests
2. Run /path/to/dist/Debug/bin/nssfuzz-tls-server /path/to/testcase

Comment 1

[Dennis Jackson]

Attachment: (secure)

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/0b4ff563fbfb
Make sure we don't accept ECH if the HRR cookie is ill-formatted. r=nss-reviewers,jschanck