google / google/conscrypt

BUFFER_OVERFLOW on wrap inconsistent with getPacketBufferSize

Open
#1,049 4 comments 0 reactions 1 assignee Claimed by @dario-weswit View on GitHub
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

Hello,

I'm testing Conscrypt 2.5.2 on the server side and I set setUseSessionTickets(sslEngine, true).
Some connections work well, but in some cases, even though the handshake succeeds, upon a later wrap I get BUFFER_OVERFLOW.
The problem is that, by later invoking getPacketBufferSize, I see that the buffer was sized accordingly, at 16709 bytes (and it was empty).
If I try doubling the buffer, the wrap works and the buffer reports 17408 bytes of data.

My suspect is that the involved operation is the production of the NewSessionTicket packet.
What I see is that the input buffer to wrap is about 90KB and wrap consumes 16384 bytes.
So, perhaps the native part returns the encrypted bytes together with the NewSessionTicket packet and this breaks the 16709 limit.

It may be difficult for me to provide a test case; please clarify if you need other specific details on the interaction.
However, I see that getPacketBufferSize always returns a constant, so it must rely on this limit to be always obeyed by the underlying native implementation.
Moreover, it seems that there is no cross-check on the size of the data received from the native part against this constant.
So, this seems like an internal inconsistency.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.