tlspr: a ServerHello too short for the extensions length refused (#1286)

A rule whose ACL was missing was handed to the filters as the
connection's data, which they read as a match data block and freed:
a pointer into the configuration, dereferenced as another type and
given back to malloc. A rule without an ACL now skips the check and
goes on with a block of its own, and nothing a filter is given is
ever the rule itself.

(cherry picked from commit a7e5a8b48b)

src/pcre.c

@@ -264,13 +264,14 @@ static FILTER_ACTION pcre_filter_client(void *fo, struct clientparam * param, vo
 	struct pcre_filter_data *rule = (struct pcre_filter_data *)fo;
 	struct pcre_client_data *pcd;
 
-	*fc = fo;
+	*fc = NULL;
 	if(!fo) return PASS;
-	if(!rule->acl) return CONTINUE;
-	memset (&tmpace, 0, sizeof(struct ace));
-	tmpace.src = rule->acl->src;
-	res = pl->ACLMatches(&tmpace, param);
-	if(!res) return PASS;
+	if(rule->acl){
+		memset (&tmpace, 0, sizeof(struct ace));
+		tmpace.src = rule->acl->src;
+		res = pl->ACLMatches(&tmpace, param);
+		if(!res) return PASS;
+	}
 	/* the connection goes on with a match data of its own */
 	if(!(pcd = pl->mallocfunc(sizeof(struct pcre_client_data)))){
 		*fc = NULL;

src/tlspr.c

@@ -224,6 +224,7 @@ int parsehello(int type, unsigned char *hello, unsigned len, char *sni, int * sn
     else if(type == 2){
 	offset += 3;
     }
+    if((offset + 2) > len) return -6;
     elen = size16(hello+offset);
     offset += 2;
     if(elen+offset != len) return -9;