crypto/tls: signature_algorithms in CertificateRequest can't be empty

FiloSottile · wwqgtxx · commit 53b65fd11ffd · 2025-09-21T13:52:29.000+08:00
Change-Id: I6a6a4656ab97e1f247df35b2589cd73461b4ac76 Reviewed-on: https://go-review.googlesource.com/c/go/+/675917 Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
diff --git a/handshake_messages.go b/handshake_messages.go
@@ -1847,7 +1847,7 @@ func (m *certificateRequestMsg) unmarshal(data []byte) bool {
 		}
 		sigAndHashLen := uint16(data[0])<<8 | uint16(data[1])
 		data = data[2:]
-		if sigAndHashLen&1 != 0 {
+		if sigAndHashLen&1 != 0 || sigAndHashLen == 0 {
 			return false
 		}
 		if len(data) < int(sigAndHashLen) {

Original file line number	Diff line number	Diff line change
`@@ -1847,7 +1847,7 @@ func (m *certificateRequestMsg) unmarshal(data []byte) bool {`
`1847`	`1847`	`}`
`1848`	`1848`	`sigAndHashLen := uint16(data[0])<<8 \| uint16(data[1])`
`1849`	`1849`	`data = data[2:]`
`1850`		`- if sigAndHashLen&1 != 0 {`
	`1850`	`+ if sigAndHashLen&1 != 0 \|\| sigAndHashLen == 0 {`
`1851`	`1851`	`return false`
`1852`	`1852`	`}`
`1853`	`1853`	`if len(data) < int(sigAndHashLen) {`