mirror of
https://github.com/openssl/openssl.git
synced 2026-06-06 20:18:09 +00:00
rootvector2
46b5165d44
For a remote CONNECTION_CLOSE, src->reason points straight into the
received packet and holds exactly reason_len bytes with no guaranteed
trailing byte. copy_tcause() did OPENSSL_memdup(src->reason, l + 1),
reading one byte past the source. The +1 is only needed to make room
for the NUL written at r[l], so allocate l + 1 but copy only the l
valid bytes.
Fixes: 40c8c756c8 "QUIC APL/CHANNEL: Wire up connection closure reason"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Jun 3 11:39:47 2026
(Merged from https://github.com/openssl/openssl/pull/31349)