Fix empty fragment handling in DTLS message reassembly. Found with libFuzzer. Bug: chromium:763097 Change-Id: I806bcfc714c0629ff7f725e37f4c0045d4ec7ac6 Reviewed-on: https://boringssl-review.googlesource.com/20105 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/ssl/d1_both.cc b/ssl/d1_both.cc index 321e01d..ab499df 100644 --- a/ssl/d1_both.cc +++ b/ssl/d1_both.cc
@@ -228,6 +228,10 @@ // A zero-length message will never have a pending reassembly. assert(msg_len > 0); + if (start == end) { + return; + } + if ((start >> 3) == (end >> 3)) { frag->reassembly[start >> 3] |= bit_range(start & 7, end & 7); } else {