<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body ><div>Thanks for the review, Xuelei. I'll make that change and run it through the tests.</div><div><br></div>--Jamil<div></div><br><br>-------- Original message --------<br>From: Xuelei Fan <xuelei.fan@oracle.com> <br>Date: 01/22/2015 4:26 PM (GMT-08:00) <br>To: security-dev@openjdk.java.net <br>Subject: Re: RFR 8044860: Vectors and fixed length fields should be verified
for allowed sizes <br><br>I may use SSLProtocolException if the size of session ID is bigger than<br>32. Otherwise, looks fine to me.<br><br>Xuelei<br><br>On 1/23/2015 2:35 AM, Jamil Nimeh wrote:<br>> Hi all,<br>> <br>> This review is to provide length checks on the session ID for SSL/TLS<br>> connections. It appears to be the only vector/array that needs<br>> additional length-checks to make sure it's not exceeding 32 bytes.<br>> <br>> Bug: https://bugs.openjdk.java.net/browse/JDK-8044860<br>> Webrev: http://cr.openjdk.java.net/~jnimeh/reviews/8044860/webrev.01<br>> <br>> Thanks,<br>> --Jamil<br><br></body>