generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix OID handling:

Browse Source 
- Upon parsing, reject OIDs with invalid base-128 encoding.
- Always NUL-terminate the destination buffer in OBJ_obj2txt printing function.

CVE-2014-3508

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Emilia Kasper
2014-07-02 19:02:33 +02:00
committed by Matt Caswell
parent 1716003376
commit 0042fb5fd1
2 changed files with 30 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
crypto/objects/obj_dat.c
View File

@@ -471,11 +471,12 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
const unsigned char *p;
char tbuf[DECIMAL_SIZE(i)+DECIMAL_SIZE(l)+2];
if ((a == NULL) || (a->data == NULL)) {
buf[0]='\0';
return(0);
}
/* Ensure that, at every state, |buf| is NUL-terminated. */
if (buf && buf_len > 0)
buf[0] = '\0';
if ((a == NULL) || (a->data == NULL))
return(0);
if (!no_name && (nid=OBJ_obj2nid(a)) != NID_undef)
{
@@ -554,9 +555,10 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
i=(int)(l/40);
l-=(long)(i*40);
}
if (buf && (buf_len > 0))
if (buf && (buf_len > 1))
{
*buf++ = i + '0';
*buf = '\0';
buf_len--;
}
n++;
@@ -571,9 +573,10 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
i = strlen(bndec);
if (buf)
{
if (buf_len > 0)
if (buf_len > 1)
{
*buf++ = '.';
*buf = '\0';
buf_len--;
}
BUF_strlcpy(buf,bndec,buf_len);
@@ -807,4 +810,3 @@ err:
OPENSSL_free(buf);
return(ok);
}