crypto/tls: fix parsing of SNI extension.

The previous code had a brain fart: it took one of the length prefixes
as an element count, not a length. This didn't actually affect anything
because the loop stops as soon as it finds a hostname element, and the
hostname element is always the first and only element. (No other element
types have ever been defined.)

This change fixes the parsing in case SNI is ever changed in the future.

Fixes #10793.

Change-Id: Iafdf3381942bc22b1f33595315c53dc6cc2e9f0f
Reviewed-on: https://go-review.googlesource.com/11059
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

diff --git a/src/crypto/tls/handshake_messages.go b/src/crypto/tls/handshake_messages.go
index b794f05815b6a01c9ad38817277eab438e29455a..799a776799aa1c158562f7e68a5712d0d68a6641 100644 (file)
--- a/src/crypto/tls/handshake_messages.go
+++ b/src/crypto/tls/handshake_messages.go
@@ -367,12 +367,16 @@ func (m *clientHelloMsg) unmarshal(data []byte) bool {
 
                switch extension {
                case extensionServerName:
-                       if length < 2 {
+                       d := data[:length]
+                       if len(d) < 2 {
                                return false
                        }
-                       numNames := int(data[0])<<8 | int(data[1])
-                       d := data[2:]
-                       for i := 0; i < numNames; i++ {
+                       namesLen := int(d[0])<<8 | int(d[1])
+                       d = d[2:]
+                       if len(d) != namesLen {
+                               return false
+                       }
+                       for len(d) > 0 {
                                if len(d) < 3 {
                                        return false
                                }
@@ -383,7 +387,7 @@ func (m *clientHelloMsg) unmarshal(data []byte) bool {
                                        return false
                                }
                                if nameType == 0 {
-                                       m.serverName = string(d[0:nameLen])
+                                       m.serverName = string(d[:nameLen])
                                        break
                                }
                                d = d[nameLen:]