From 8fa9fae99ebbb700abf8e74c40d0f9a9085d9674 Mon Sep 17 00:00:00 2001 From: Gaurav Singh Date: Mon, 23 Mar 2026 23:42:10 +0530 Subject: [PATCH 1/6] fixed .net test issue for opensuse 16 and sles 16 --- .github/workflows/validate-linux-packages-reuse.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/validate-linux-packages-reuse.yml b/.github/workflows/validate-linux-packages-reuse.yml index 3eea817524..e62503b9de 100644 --- a/.github/workflows/validate-linux-packages-reuse.yml +++ b/.github/workflows/validate-linux-packages-reuse.yml @@ -609,7 +609,8 @@ jobs: run: | docker exec ${{ steps.container.outputs.name }} sh -c ' # Find and run the self-contained QuicHello executable - EXE=$(find /dotnet -maxdepth 1 -name "QuicHello*" -type f ! -name "*.dll" ! -name "*.pdb" ! -name "*.json" 2>/dev/null | head -1) + # Use ls+grep instead of find negation, which is unreliable on BusyBox (OpenSUSE/SLES) + EXE=$(ls /dotnet/QuicHello* 2>/dev/null | grep -v -e "\.dll$" -e "\.pdb$" -e "\.json$" | head -1) if [ -z "$EXE" ]; then echo "ERROR: QuicHello executable not found" ls -la /dotnet/ From 19a54a9cc72da6228f3dd674e2532edc61fd20e9 Mon Sep 17 00:00:00 2001 From: Gaurav Singh Date: Tue, 11 Aug 2026 02:26:28 +0530 Subject: [PATCH 2/6] Fix TLS openssl Finsihed OOB read --- src/platform/tls_openssl.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/platform/tls_openssl.c b/src/platform/tls_openssl.c index 61c42fec15..49277dfdc0 100644 --- a/src/platform/tls_openssl.c +++ b/src/platform/tls_openssl.c @@ -2885,11 +2885,15 @@ static int SplitAddRecord(RECORD_ENTRY *Entry, size_t *Consumed) // if (message_type == SSL3_MT_FINISHED) { // - // Trim the buffer so we end on a record boundary - // Everything after the HandShakeFinished record - // Is just padding + // message_size is untrusted: only ever trim (never grow) RecLen. + // Reject an over-length FINISHED to avoid an OOB read downstream. // - Entry->RecLen = total_message_size + message_size + 4; + size_t finished_end = total_message_size + (size_t)message_size + 4; + if (finished_end > Entry->RecLen) { + CXPLAT_FREE(Entry, QUIC_POOL_TLS_RECORD_ENTRY); + return -1; + } + Entry->RecLen = finished_end; goto insert_now; } From 3b661824d701e2bd442430539b937bc5f2e609b7 Mon Sep 17 00:00:00 2001 From: Gaurav Singh Date: Tue, 11 Aug 2026 16:45:20 +0530 Subject: [PATCH 3/6] reordered logic --- src/platform/tls_openssl.c | 40 +++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 22 deletions(-) diff --git a/src/platform/tls_openssl.c b/src/platform/tls_openssl.c index 49277dfdc0..e8cdde9595 100644 --- a/src/platform/tls_openssl.c +++ b/src/platform/tls_openssl.c @@ -2881,35 +2881,31 @@ static int SplitAddRecord(RECORD_ENTRY *Entry, size_t *Consumed) // - // Stop processing if this is a handshake finished record + // If this message extends past the end of the record, its remainder + // is in a later datagram, so it is incomplete. This also bounds the + // untrusted message_size against the buffer we actually received. // - if (message_type == SSL3_MT_FINISHED) { - // - // message_size is untrusted: only ever trim (never grow) RecLen. - // Reject an over-length FINISHED to avoid an OOB read downstream. - // - size_t finished_end = total_message_size + (size_t)message_size + 4; - if (finished_end > Entry->RecLen) { - CXPLAT_FREE(Entry, QUIC_POOL_TLS_RECORD_ENTRY); - return -1; - } - Entry->RecLen = finished_end; - goto insert_now; + if (total_message_size + message_size + 4 > Entry->RecLen) { + Incomplete = 1; } // - // If this message is larger then the total record length - // then we need to create an Incomplete record as its remainder - // is in the next datagram - // also, if this is an epoch key change message (8 is EncryptedExtensions) - // then we need to split it as rcv_rec expects that - // Note we only need to force the split if the epoch change - // isn't the first message in this record + // A handshake FINISHED ends the flight; everything after it is just + // padding. If the message is complete, trim the record to its + // boundary and insert it. If it is incomplete, fall through to the + // incomplete handling below to wait for the remainder, so RecLen is + // never grown past the buffer (which would cause an OOB read). // - if (total_message_size + message_size + 4 > Entry->RecLen) { - Incomplete = 1; + if (message_type == SSL3_MT_FINISHED && Incomplete == 0) { + Entry->RecLen = total_message_size + message_size + 4; + goto insert_now; } + // + // An epoch key change message (8 is EncryptedExtensions) must be + // split as rcv_rec expects it isolated, but only if it isn't the + // first message in this record. + // if ((message_type == 8) && (total_message_size != 0)) { force_split = 1; } From f6215fb7fbe5d44d5258598919693a702d153ad7 Mon Sep 17 00:00:00 2001 From: Gaurav Singh Date: Wed, 12 Aug 2026 19:11:47 +0530 Subject: [PATCH 4/6] refactored comment --- src/platform/tls_openssl.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/platform/tls_openssl.c b/src/platform/tls_openssl.c index e8cdde9595..2b3db36254 100644 --- a/src/platform/tls_openssl.c +++ b/src/platform/tls_openssl.c @@ -2882,19 +2882,16 @@ static int SplitAddRecord(RECORD_ENTRY *Entry, size_t *Consumed) // // If this message extends past the end of the record, its remainder - // is in a later datagram, so it is incomplete. This also bounds the - // untrusted message_size against the buffer we actually received. + // is in a later datagram, so it is incomplete. // if (total_message_size + message_size + 4 > Entry->RecLen) { Incomplete = 1; } // - // A handshake FINISHED ends the flight; everything after it is just - // padding. If the message is complete, trim the record to its - // boundary and insert it. If it is incomplete, fall through to the - // incomplete handling below to wait for the remainder, so RecLen is - // never grown past the buffer (which would cause an OOB read). + // A complete handshake FINISHED ends the flight, so trim the record + // to its end and ignore any padding that follows. An incomplete one + // is handled like any other incomplete message below. // if (message_type == SSL3_MT_FINISHED && Incomplete == 0) { Entry->RecLen = total_message_size + message_size + 4; From b754d2823ccb4e099b1021f74b98ac6421486c5b Mon Sep 17 00:00:00 2001 From: Gaurav Singh Date: Thu, 13 Aug 2026 01:00:04 +0530 Subject: [PATCH 5/6] formatted comment --- src/platform/tls_openssl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/platform/tls_openssl.c b/src/platform/tls_openssl.c index 2b3db36254..b622c94e10 100644 --- a/src/platform/tls_openssl.c +++ b/src/platform/tls_openssl.c @@ -2869,7 +2869,7 @@ static int SplitAddRecord(RECORD_ENTRY *Entry, size_t *Consumed) message_size = htonl(message_size) & 0x00ffffff; // - //make sure our message type is valid + // Make sure our message type is valid // if (message_type > SSL3_MT_FINISHED) { // From f0dd8a305504193f2f696e8ba41229ca53d74e86 Mon Sep 17 00:00:00 2001 From: Gaurav Singh Date: Thu, 13 Aug 2026 19:10:58 +0530 Subject: [PATCH 6/6] Made check less strict --- src/platform/tls_openssl.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/src/platform/tls_openssl.c b/src/platform/tls_openssl.c index 65df30ffd3..ba70dfa50b 100644 --- a/src/platform/tls_openssl.c +++ b/src/platform/tls_openssl.c @@ -2867,18 +2867,6 @@ static int SplitAddRecord(RECORD_ENTRY *Entry, size_t *Consumed) // message_size = htonl(message_size) & 0x00ffffff; - // - // Make sure our message type is valid - // - if (message_type > SSL3_MT_FINISHED) { - // - // This is not a real handshake record - // - CXPLAT_FREE(Entry, QUIC_POOL_TLS_RECORD_ENTRY); - return -1; - } - - // // If this message extends past the end of the record, its remainder // is in a later datagram, so it is incomplete.