generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

More complete input validation of X509_check_mumble

Browse Source 
(cherry picked from commit 29edebe95c2a51470c78c7e769c926719965eeb1)
This commit is contained in:
Viktor Dukhovni 2014-06-22 20:18:53 -04:00 committed by Dr. Stephen Henson
parent d93edc0aab
commit 3d15d58e55
1 changed files with 29 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
crypto/x509v3/v3_utl.c
View File

@ -972,22 +972,46 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen,
int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen, int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,
unsigned int flags) unsigned int flags)
{ {
if (chk == NULL)
return -2;
/*
* Embedded NULs are disallowed, except as the last character of a
* string of length 2 or more (tolerate caller including terminating
* NUL in string length).
*/
if (chklen == 0) if (chklen == 0)
chklen = chk ? strlen((char *)chk) : 0; chklen = strlen((char *)chk);
else if (chk && memchr(chk, '\0', chklen)) else if (memchr(chk, '\0', chklen > 1 ? chklen-1 : chklen))
return 0; return -2;
if (chklen > 1 && chk[chklen-1] == '\0')
--chklen;
return do_x509_check(x, chk, chklen, flags, GEN_DNS); return do_x509_check(x, chk, chklen, flags, GEN_DNS);
} }
int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen, int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen,
unsigned int flags) unsigned int flags)
{ {
if (chk == NULL)
return -2;
/*
* Embedded NULs are disallowed, except as the last character of a
* string of length 2 or more (tolerate caller including terminating
* NUL in string length).
*/
if (chklen == 0)
chklen = strlen((char *)chk);
else if (memchr(chk, '\0', chklen > 1 ? chklen-1 : chklen))
return -2;
if (chklen > 1 && chk[chklen-1] == '\0')
--chklen;
return do_x509_check(x, chk, chklen, flags, GEN_EMAIL); return do_x509_check(x, chk, chklen, flags, GEN_EMAIL);
} }
int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen, int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
unsigned int flags) unsigned int flags)
{ {
if (chk == NULL)
return -2;
return do_x509_check(x, chk, chklen, flags, GEN_IPADD); return do_x509_check(x, chk, chklen, flags, GEN_IPADD);
} }
@ -995,6 +1019,8 @@ int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags)
{ {
unsigned char ipout[16]; unsigned char ipout[16];
int iplen; int iplen;
if (ipasc == NULL)
return -2;
iplen = a2i_ipadd(ipout, ipasc); iplen = a2i_ipadd(ipout, ipasc);
if (iplen == 0) if (iplen == 0)
return -2; return -2;