mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2025-03-08 10:09:54 +00:00
Fix potential integer overflow parsing DER CRT
This patch prevents a potential signed integer overflow during the certificate version verification checks.
This commit is contained in:
parent
26124be17a
commit
47f3059780
|
@ -17,6 +17,9 @@ Bugfix
|
|||
encoded X509 CRLs. The overflow would enable maliciously constructed CRLs
|
||||
to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
|
||||
KNOX Security, Samsung Research America
|
||||
* Fix a potential integer overflow in the version verification for DER
|
||||
encoded X509 certificates. The overflow would enable maliciously
|
||||
constructed certificates to bypass the certificate verification check.
|
||||
|
||||
= mbed TLS 1.3.20 branch released 2017-06-21
|
||||
|
||||
|
|
|
@ -619,14 +619,14 @@ static int x509_crt_parse_der_core( x509_crt *crt, const unsigned char *buf,
|
|||
return( ret );
|
||||
}
|
||||
|
||||
crt->version++;
|
||||
|
||||
if( crt->version > 3 )
|
||||
if( crt->version < 0 || crt->version > 2 )
|
||||
{
|
||||
x509_crt_free( crt );
|
||||
return( POLARSSL_ERR_X509_UNKNOWN_VERSION );
|
||||
}
|
||||
|
||||
crt->version++;
|
||||
|
||||
if( ( ret = x509_get_sig_alg( &crt->sig_oid1, &sig_params1,
|
||||
&crt->sig_md, &crt->sig_pk,
|
||||
&crt->sig_opts ) ) != 0 )
|
||||
|
|
Loading…
Reference in a new issue