yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-24 02:21:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix memory leak parsing some X.509 certs

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2014-10-23 14:53:46 +02:00
parent 308a586477
commit 6b44038913
3 changed files with 30 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
ChangeLog
View file

@ -1,5 +1,16 @@
PolarSSL ChangeLog PolarSSL ChangeLog
= Version 1.2.12 released 2014-10-??
Security
* Remotely-triggerable memory leak when parsing some X.509 certificates
(server is not affected if it doesn't ask for a client certificate).
(Found using Codenomicon Defensics.)
Changes
* X.509 certificates with more than one AttributeTypeAndValue per
RelativeDistinguishedName are not accepted any more.
= Version 1.2.11 released 2014-07-11 = Version 1.2.11 released 2014-07-11
Features Features
* Entropy module now supports seed writing and reading * Entropy module now supports seed writing and reading

42
library/x509parse.c
View file

@ -283,48 +283,38 @@ static int x509_get_attr_type_value( unsigned char **p,
* AttributeType ::= OBJECT IDENTIFIER * AttributeType ::= OBJECT IDENTIFIER
* *
* AttributeValue ::= ANY DEFINED BY AttributeType * AttributeValue ::= ANY DEFINED BY AttributeType
*
* We restrict RelativeDistinguishedName to be a set of 1 element. This is
* the most common case, and our x509_name structure currently can't handle
* more than that.
*/ */
static int x509_get_name( unsigned char **p, static int x509_get_name( unsigned char **p,
const unsigned char *end, const unsigned char *end,
x509_name *cur ) x509_name *cur )
{ {
int ret; int ret;
size_t len; size_t set_len;
const unsigned char *end2; const unsigned char *end_set;
x509_name *use;
if( ( ret = asn1_get_tag( p, end, &len, /*
* parse first SET, restricted to 1 element
*/
if( ( ret = asn1_get_tag( p, end, &set_len,
ASN1_CONSTRUCTED | ASN1_SET ) ) != 0 ) ASN1_CONSTRUCTED | ASN1_SET ) ) != 0 )
return( POLARSSL_ERR_X509_CERT_INVALID_NAME + ret ); return( POLARSSL_ERR_X509_CERT_INVALID_NAME + ret );
end2 = end; end_set = *p + set_len;
end = *p + len;
use = cur;
do if( ( ret = x509_get_attr_type_value( p, end_set, cur ) ) != 0 )
{
if( ( ret = x509_get_attr_type_value( p, end, use ) ) != 0 )
return( ret ); return( ret );
if( *p != end ) if( *p != end_set )
{ return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE );
use->next = (x509_name *) malloc(
sizeof( x509_name ) );
if( use->next == NULL )
return( POLARSSL_ERR_X509_MALLOC_FAILED );
memset( use->next, 0, sizeof( x509_name ) );
use = use->next;
}
}
while( *p != end );
/* /*
* recurse until end of SEQUENCE is reached * recurse until end of SEQUENCE is reached
*/ */
if( *p == end2 ) if( *p == end )
return( 0 ); return( 0 );
cur->next = (x509_name *) malloc( cur->next = (x509_name *) malloc(
@ -335,7 +325,7 @@ static int x509_get_name( unsigned char **p,
memset( cur->next, 0, sizeof( x509_name ) ); memset( cur->next, 0, sizeof( x509_name ) );
return( x509_get_name( p, end2, cur->next ) ); return( x509_get_name( p, end, cur->next ) );
} }
/* /*

2
tests/suites/test_suite_x509parse.data
View file

@ -462,7 +462,7 @@ X509 Certificate ASN1 (TBSCertificate, issuer, no string data)
x509parse_crt:"30253023a0030201028204deadbeef300d06092a864886f70d0101020500300731053003060013":"":POLARSSL_ERR_X509_CERT_INVALID_NAME + POLARSSL_ERR_ASN1_OUT_OF_DATA x509parse_crt:"30253023a0030201028204deadbeef300d06092a864886f70d0101020500300731053003060013":"":POLARSSL_ERR_X509_CERT_INVALID_NAME + POLARSSL_ERR_ASN1_OUT_OF_DATA
X509 Certificate ASN1 (TBSCertificate, issuer, no full following string) X509 Certificate ASN1 (TBSCertificate, issuer, no full following string)
x509parse_crt:"302b3029a0030201028204deadbeef300d06092a864886f70d0101020500300d310b3009060013045465737400":"":POLARSSL_ERR_X509_CERT_INVALID_NAME + POLARSSL_ERR_ASN1_UNEXPECTED_TAG x509parse_crt:"302b3029a0030201028204deadbeef300d06092a864886f70d0101020500300d310b3009060013045465737400":"":POLARSSL_ERR_X509_FEATURE_UNAVAILABLE
X509 Certificate ASN1 (TBSCertificate, valid issuer, no validity) X509 Certificate ASN1 (TBSCertificate, valid issuer, no validity)
x509parse_crt:"302a3028a0030201028204deadbeef300d06092a864886f70d0101020500300c310a30080600130454657374":"":POLARSSL_ERR_X509_CERT_INVALID_DATE + POLARSSL_ERR_ASN1_OUT_OF_DATA x509parse_crt:"302a3028a0030201028204deadbeef300d06092a864886f70d0101020500300c310a30080600130454657374":"":POLARSSL_ERR_X509_CERT_INVALID_DATE + POLARSSL_ERR_ASN1_OUT_OF_DATA