generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix the ASN1 sanity check: correct header length

Browse Source 
calculation and check overflow against LONG_MAX.
This commit is contained in:
Dr. Stephen Henson 2002-08-02 18:42:40 +00:00
parent 265a9e2c5d
commit b012127a99
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES
View File

@ -1669,6 +1669,12 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
Changes between 0.9.6e and 0.9.6f [XX xxx XXXX] Changes between 0.9.6e and 0.9.6f [XX xxx XXXX]
*) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
and get fix the header length calculation.
[Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>,
Alon Kantor <alonk@checkpoint.com> (and others),
Steve Henson]
*) Use proper error handling instead of 'assertions' in buffer *) Use proper error handling instead of 'assertions' in buffer
overflow checks added in 0.9.6e. This prevents DoS (the overflow checks added in 0.9.6e. This prevents DoS (the
assertions could call abort()). assertions could call abort()).

9
crypto/asn1/asn1_lib.c
View File

@ -57,6 +57,7 @@
*/ */
#include <stdio.h> #include <stdio.h>
#include <limits.h>
#include "cryptlib.h" #include "cryptlib.h"
#include <openssl/asn1.h> #include <openssl/asn1.h>
#include <openssl/asn1_mac.h> #include <openssl/asn1_mac.h>
@ -124,7 +125,7 @@ int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
(int)(omax+ *pp)); (int)(omax+ *pp));
#endif #endif
if (*plength > (omax - (*pp - p))) if (*plength > (omax - (*p - *pp)))
{ {
ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG); ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
/* Set this so that even if things are not long enough /* Set this so that even if things are not long enough
@ -141,7 +142,7 @@ err:
static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max) static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
{ {
unsigned char *p= *pp; unsigned char *p= *pp;
long ret=0; unsigned long ret=0;
int i; int i;
if (max-- < 1) return(0); if (max-- < 1) return(0);
@ -170,10 +171,10 @@ static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
else else
ret=i; ret=i;
} }
if (ret < 0) if (ret > LONG_MAX)
return 0; return 0;
*pp=p; *pp=p;
*rl=ret; *rl=(long)ret;
return(1); return(1);
} }