client key exchange: fail if the client KX message is padded with additional bytes

2 files changed, 7 insertions, 1 deletions

diff --git a/lib/auth/dh_common.c b/lib/auth/dh_common.c
index cbb538f58d..d5b953ed27 100644
--- a/lib/auth/dh_common.c
+++ b/lib/auth/dh_common.c
@@ -71,6 +71,10 @@ _gnutls_proc_dh_common_client_kx(gnutls_session_t session,
 	_n_Y = n_Y;
 
 	DECR_LEN(data_size, n_Y);
+
+	if (data_size != 0)
+		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+
 	if (_gnutls_mpi_init_scan_nz(&session->key.client_Y, &data[2], _n_Y)) {
 		gnutls_assert();
 		return GNUTLS_E_MPI_SCAN_FAILED;
@@ -87,7 +91,6 @@ _gnutls_proc_dh_common_client_kx(gnutls_session_t session,
 		goto error;
 	}
 
-
 	if (psk_key == NULL) {
 		session->key.key.data = tmp_dh_key.data;
 		session->key.key.size = tmp_dh_key.size;
diff --git a/lib/auth/ecdhe.c b/lib/auth/ecdhe.c
index 60340dd97a..bfd8000318 100644
--- a/lib/auth/ecdhe.c
+++ b/lib/auth/ecdhe.c
@@ -159,6 +159,9 @@ int _gnutls_proc_ecdh_common_client_kx(gnutls_session_t session,
 		goto cleanup;
 	}
 
+	if (data_size != 0)
+		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+
 	/* generate pre-shared key */
 	ret = calc_ecdh_key(session, psk_key, curve);
 	if (ret < 0) {