64 lines
2.5 KiB
Diff
64 lines
2.5 KiB
Diff
|
From d9d838ddc0ed083fb4c26dd067e71aad7c65ad16 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Ingo Schwarze <schwarze@openbsd.org>
|
||
|
|
Date: Sun, 18 Jul 2021 17:48:06 +0200
|
||
|
|
Subject: [PATCH] Fix a read buffer overrun in X509_aux_print().
|
||
|
|
|
||
|
|
The ASN1_STRING_get0_data(3) manual explitely cautions the reader
|
||
|
|
that the data is not necessarily NUL-terminated, and the function
|
||
|
|
X509_alias_set1(3) does not sanitize the data passed into it in any
|
||
|
|
way either, so we must assume the return value from X509_alias_get0(3)
|
||
|
|
is merely a byte array and not necessarily a string in the sense
|
||
|
|
of the C language.
|
||
|
|
|
||
|
|
I found this bug while writing manual pages for X509_print_ex(3)
|
||
|
|
and related functions. Theo Buehler <tb@openbsd.org> checked my
|
||
|
|
patch to fix the same bug in LibreSSL, see
|
||
|
|
|
||
|
|
http://cvsweb.openbsd.org/src/lib/libcrypto/asn1/t_x509a.c#rev1.9
|
||
|
|
|
||
|
|
As an aside, note that the function still produces incomplete and
|
||
|
|
misleading results when the data contains a NUL byte in the middle
|
||
|
|
and that error handling is consistently absent throughout, even
|
||
|
|
though the function provides an "int" return value obviously intended
|
||
|
|
to be 1 for success and 0 for failure, and even though this function
|
||
|
|
is called by another function that also wants to return 1 for success
|
||
|
|
and 0 for failure and even does so in many of its code paths, though
|
||
|
|
not in others. But let's stay focussed. Many things would be nice
|
||
|
|
to have in the wide wild world, but a buffer overflow must not be
|
||
|
|
allowed to remain in our backyard.
|
||
|
|
|
||
|
|
CLA: trivial
|
||
|
|
|
||
|
|
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
||
|
|
Reviewed-by: Paul Dale <pauli@openssl.org>
|
||
|
|
Reviewed-by: Tomas Mraz <tomas@openssl.org>
|
||
|
|
(Merged from https://github.com/openssl/openssl/pull/16108)
|
||
|
|
|
||
|
|
(cherry picked from commit c5dc9ab965f2a69bca964c709e648158f3e4cd67)
|
||
|
|
|
||
|
|
Reference: https://github.com/openssl/openssl/commit/d9d838ddc0ed083fb4c26dd067e71aad7c65ad16
|
||
|
|
Conflict: NA
|
||
|
|
---
|
||
|
|
crypto/x509/t_x509.c | 4 ++--
|
||
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/crypto/x509/t_x509.c b/crypto/x509/t_x509.c
|
||
|
|
index 12d807f705..3ba0b3a045 100644
|
||
|
|
--- a/crypto/x509/t_x509.c
|
||
|
|
+++ b/crypto/x509/t_x509.c
|
||
|
|
@@ -365,9 +365,9 @@ int X509_aux_print(BIO *out, X509 *x, int indent)
|
||
|
|
BIO_puts(out, "\n");
|
||
|
|
} else
|
||
|
|
BIO_printf(out, "%*sNo Rejected Uses.\n", indent, "");
|
||
|
|
- alias = X509_alias_get0(x, NULL);
|
||
|
|
+ alias = X509_alias_get0(x, &i);
|
||
|
|
if (alias)
|
||
|
|
- BIO_printf(out, "%*sAlias: %s\n", indent, "", alias);
|
||
|
|
+ BIO_printf(out, "%*sAlias: %.*s\n", indent, "", i, alias);
|
||
|
|
keyid = X509_keyid_get0(x, &keyidlen);
|
||
|
|
if (keyid) {
|
||
|
|
BIO_printf(out, "%*sKey Id: ", indent, "");
|
||
|
|
--
|
||
|
|
2.23.0
|
||
|
|
|