diff options
| author | Bob Beck <beck@cvs.openbsd.org> | 2020-09-20 18:22:32 +0000 |
|---|---|---|
| committer | Bob Beck <beck@cvs.openbsd.org> | 2020-09-20 18:22:32 +0000 |
| commit | 55b779c748471b779ea2289553325152c97b89bd (patch) | |
| tree | c82f248c4b170fce23271608cbfaff950d3f5392 /lib/libcrypto/x509 | |
| parent | 0a2d3e028a742a1729bbe04192ec858ee2bdfd59 (diff) | |
Correct a 1 byte read overflow in x509_contraints_uri and add
regress to catch it in the future.
found by Guido Vranken's cryptofuzzer
ok tb@
Diffstat (limited to 'lib/libcrypto/x509')
| -rw-r--r-- | lib/libcrypto/x509/x509_constraints.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/lib/libcrypto/x509/x509_constraints.c b/lib/libcrypto/x509/x509_constraints.c index 5abea52e597..8fafadfcdf2 100644 --- a/lib/libcrypto/x509/x509_constraints.c +++ b/lib/libcrypto/x509/x509_constraints.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509_constraints.c,v 1.5 2020/09/20 03:19:52 tb Exp $ */ +/* $OpenBSD: x509_constraints.c,v 1.6 2020/09/20 18:22:31 beck Exp $ */ /* * Copyright (c) 2020 Bob Beck <beck@openbsd.org> * @@ -438,7 +438,7 @@ x509_constraints_valid_domain_constraint(uint8_t *constraint, size_t len) * the caller must free, or or NULL if it could not be found or is * invalid. * - * rfc 3986: + * RFC 3986: * the authority part of a uri starts with // and is terminated with * the next '/', '?', '#' or end of the URI. * @@ -454,7 +454,12 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char**hostpart) uint8_t *authority = NULL; char *host = NULL; - /* find first // */ + /* + * Find first '//'. there must be at least a '//' and + * something else. + */ + if (len < 3) + return 0; for (i = 0; i < len - 1; i++) { if (!isascii(uri[i])) return 0; @@ -557,7 +562,7 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint, size_t len, int *error) { int ret = 0; - char *hostpart; + char *hostpart = NULL; if (!x509_constraints_uri_host(uri, ulen, &hostpart)) { *error = X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |