* ext/openssl/ossl_ssl.c (ssl_npn_select_cb): explicitly raise error

  in ext/openssl instead of OpenSSL itself because LibreSSL
  silently truncate the selected protocol name by casting the length
  from int to unsigned char. [Bug #11369]
  Patch by Jeremy Evans <[email protected]>

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@52227 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 5 insertions, 2 deletions

diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
index 3e6e164682..ae9f3ca8d7 100644
--- a/ext/openssl/ossl_ssl.c
+++ b/ext/openssl/ossl_ssl.c
@@ -599,9 +599,12 @@ ssl_npn_select_cb(SSL *s, unsigned char **out, unsigned char *outlen, const unsi
 
     selected = rb_funcall(cb, rb_intern("call"), 1, protocols);
     StringValue(selected);
+    i = RSTRING_LENINT(selected);
+    if (i < 1 || i >= 256) {
+	    ossl_raise(eSSLError, "Selected protocol must have length 1..255");
+    }
     *out = (unsigned char *) StringValuePtr(selected);
-    *outlen = RSTRING_LENINT(selected);
-
+    *outlen = i;
     return SSL_TLSEXT_ERR_OK;
 }