Port ssl3_get_new_session_ticket to CBS.

Change-Id: Iabca923c9be48d001abd3b12b8c6898e604aa85a
Reviewed-on: https://boringssl-review.googlesource.com/1165
Reviewed-by: Adam Langley <agl@google.com>

include/openssl/ssl.h

diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index 7f23cc7..01afe68 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -491,9 +491,9 @@
 	unsigned char *tlsext_ellipticcurvelist; /* peer's list */
 #endif /* OPENSSL_NO_EC */
 	/* RFC4507 info */
-	unsigned char *tlsext_tick;	/* Session ticket */
+	uint8_t *tlsext_tick;	/* Session ticket */
 	size_t tlsext_ticklen;		/* Session ticket length */
-	long tlsext_tick_lifetime_hint;	/* Session lifetime hint in seconds */
+	uint32_t tlsext_tick_lifetime_hint;	/* Session lifetime hint in seconds */
 	char peer_sha256_valid;		/* Non-zero if peer_sha256 is valid */
 	unsigned char peer_sha256[SHA256_DIGEST_LENGTH];  /* SHA256 of peer certificate */
 

ssl/s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 3165805..e3e58e8 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1905,10 +1905,9 @@
 
 int ssl3_get_new_session_ticket(SSL *s)
 	{
-	int ok,al,ret=0, ticklen;
+	int ok,al,ret=0;
 	long n;
-	const unsigned char *p;
-	unsigned char *d;
+	CBS new_session_ticket, ticket;
 
 	n=s->method->ssl_get_message(s,
 		SSL3_ST_CR_SESSION_TICKET_A,
@@ -1931,37 +1930,24 @@
 		OPENSSL_PUT_ERROR(SSL, ssl3_get_new_session_ticket, SSL_R_BAD_MESSAGE_TYPE);
 		goto f_err;
 		}
-	if (n < 6)
+
+	CBS_init(&new_session_ticket, s->init_msg, n);
+
+	if (!CBS_get_u32(&new_session_ticket, &s->session->tlsext_tick_lifetime_hint) ||
+		!CBS_get_u16_length_prefixed(&new_session_ticket, &ticket) ||
+		CBS_len(&new_session_ticket) != 0)
 		{
-		/* need at least ticket_lifetime_hint + ticket length */
 		al = SSL_AD_DECODE_ERROR;
-		OPENSSL_PUT_ERROR(SSL, ssl3_get_new_session_ticket, SSL_R_LENGTH_MISMATCH);
+		OPENSSL_PUT_ERROR(SSL, ssl3_get_new_session_ticket, SSL_R_DECODE_ERROR);
 		goto f_err;
 		}
 
-	p = d = s->init_msg;
-	n2l(p, s->session->tlsext_tick_lifetime_hint);
-	n2s(p, ticklen);
-	/* ticket_lifetime_hint + ticket_length + ticket */
-	if (ticklen + 6 != n)
-		{
-		al = SSL_AD_DECODE_ERROR;
-		OPENSSL_PUT_ERROR(SSL, ssl3_get_new_session_ticket, SSL_R_LENGTH_MISMATCH);
-		goto f_err;
-		}
-	if (s->session->tlsext_tick)
-		{
-		OPENSSL_free(s->session->tlsext_tick);
-		s->session->tlsext_ticklen = 0;
-		}
-	s->session->tlsext_tick = OPENSSL_malloc(ticklen);
-	if (!s->session->tlsext_tick)
+	if (!CBS_stow(&ticket, &s->session->tlsext_tick, &s->session->tlsext_ticklen))
 		{
 		OPENSSL_PUT_ERROR(SSL, ssl3_get_new_session_ticket, ERR_R_MALLOC_FAILURE);
 		goto err;
 		}
-	memcpy(s->session->tlsext_tick, p, ticklen);
-	s->session->tlsext_ticklen = ticklen;
+
 	/* There are two ways to detect a resumed ticket sesion.
 	 * One is to set an appropriate session ID and then the server
 	 * must return a match in ServerHello. This allows the normal
@@ -1977,7 +1963,7 @@
 	 * to the SHA256 (or SHA1 is SHA256 is disabled) hash of the
 	 * ticket.
 	 */ 
-	EVP_Digest(p, ticklen,
+	EVP_Digest(CBS_data(&ticket), CBS_len(&ticket),
 			s->session->session_id, &s->session->session_id_length,
 #ifndef OPENSSL_NO_SHA256
 							EVP_sha256(), NULL);

ssl/ssl_txt.c

diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
index 4ea3eb5..96a0d78 100644
--- a/ssl/ssl_txt.c
+++ b/ssl/ssl_txt.c
@@ -80,6 +80,7 @@
  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
  * OTHERWISE. */
 
+#include <inttypes.h>
 #include <stdio.h>
 
 #include <openssl/buf.h>
@@ -176,7 +177,7 @@
 	if (x->tlsext_tick_lifetime_hint)
 		{
 		if (BIO_printf(bp,
-			"\n    TLS session ticket lifetime hint: %ld (seconds)",
+			"\n    TLS session ticket lifetime hint: %" PRIu32 " (seconds)",
 			x->tlsext_tick_lifetime_hint) <=0)
 			goto err;
 		}