yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-05-05 04:56:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential overflow in CertificateRequest

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-10-02 11:16:47 +02:00
parent 9a656a0aaa
commit d64f1ad98b
2 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ChangeLog
View file

@ -18,6 +18,10 @@ Security
* Fix possible heap buffer overflow in base64_encode() when the input * Fix possible heap buffer overflow in base64_encode() when the input
buffer is 512MB or larger on 32-bit platforms. buffer is 512MB or larger on 32-bit platforms.
Found by Guido Vranken. Not trigerrable remotely in TLS. Found by Guido Vranken. Not trigerrable remotely in TLS.
* Fix potential heap buffer overflow in servers that perform client
authentication against a crafted CA cert. Cannot be triggered remotely
unless you allow third parties to pick trust CAs for client auth.
Found by Guido Vranken.
= Version 1.2.16 released 2015-09-17 = Version 1.2.16 released 2015-09-17

11
library/ssl_srv.c
View file

@ -923,6 +923,7 @@ static int ssl_write_certificate_request( ssl_context *ssl )
size_t n = 0, dn_size, total_dn_size; size_t n = 0, dn_size, total_dn_size;
unsigned char *buf, *p; unsigned char *buf, *p;
const x509_cert *crt; const x509_cert *crt;
const unsigned char * const end = ssl->out_msg + SSL_MAX_CONTENT_LEN;
SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
@ -987,10 +988,14 @@ static int ssl_write_certificate_request( ssl_context *ssl )
total_dn_size = 0; total_dn_size = 0;
while( crt != NULL && crt->version != 0) while( crt != NULL && crt->version != 0)
{ {
if( p - buf > 4096 )
break;
dn_size = crt->subject_raw.len; dn_size = crt->subject_raw.len;
if( end < p || (size_t)( end - p ) < 2 + dn_size )
{
SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
break;
}
*p++ = (unsigned char)( dn_size >> 8 ); *p++ = (unsigned char)( dn_size >> 8 );
*p++ = (unsigned char)( dn_size ); *p++ = (unsigned char)( dn_size );
memcpy( p, crt->subject_raw.p, dn_size ); memcpy( p, crt->subject_raw.p, dn_size );