yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-04-19 12:21:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential heap corruption on Windows

Browse source 
If len is large enough, when cast to an int it will be negative and then the
test if( len > MAX_PATH - 3 ) will not behave as expected.

Ref: IOTSSL-518

backport of 261faed725
This commit is contained in:
Manuel Pégourié-Gonnard 2015-10-21 10:16:29 +02:00 committed by Manuel Pégourié-Gonnard
parent 9c52176776
commit 215a14bf29
2 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog
View file

@ -6,6 +6,9 @@ Security
* Fix potential double free if ssl_set_psk() is called more than once and
some allocation fails. Cannot be forced remotely. Found by Guido Vranken,
Intelworks.
* Fix potential heap corruption on Windows when
x509_crt_parse_path() is passed a path longer than 2GB. Cannot be
triggered remotely. Found by Guido Vranken, Interlworks.
= mbed TLS 1.3.14 released 2015-10-06

4
library/x509_crt.c
View file

@ -973,7 +973,7 @@ int x509_crt_parse_path( x509_crt *chain, const char *path )
WCHAR szDir[MAX_PATH];
char filename[MAX_PATH];
char *p;
int len = (int) strlen( path );
size_t len = strlen( path );
WIN32_FIND_DATAW file_data;
HANDLE hFind;
@ -1007,7 +1007,7 @@ int x509_crt_parse_path( x509_crt *chain, const char *path )
w_ret = WideCharToMultiByte( CP_ACP, 0, file_data.cFileName,
lstrlenW( file_data.cFileName ),
p, len - 1,
p, (int) len - 1,
NULL, NULL );
if( w_ret == 0 )
return( POLARSSL_ERR_X509_FILE_IO_ERROR );