wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-29 18:27:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overflow in PKCS7_VerifySignedData

Browse Source 
wc_PKCS7_AddDataToStream() was called the first time prior to BERtoDER
conversion, subsequent times afterwards which meant the stream idx
pointer was incorrect. This patch restarts the stream after conversion.

Fixes ZD13476
This commit is contained in:
Andrew Hutchings
2022-01-13 14:49:31 +00:00
parent 92d01611ff
commit 1a4bc322f7
1 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
wolfcrypt/src/pkcs7.c
View File

@ -4451,17 +4451,32 @@ static int PKCS7_VerifySignedData(PKCS7* pkcs7, const byte* hashBuf,
return ret;
pkiMsg = in = pkcs7->der;
pkiMsgSz = pkcs7->derSz = len;
pkiMsgSz = inSz = pkcs7->derSz = len;
idx = 0;
if (GetSequence_ex(pkiMsg, &idx, &length, pkiMsgSz,
NO_USER_CHECK) < 0)
return ASN_PARSE_E;
#ifndef NO_PKCS7_STREAM
wc_PKCS7_ResetStream(pkcs7);
if ((ret = wc_PKCS7_AddDataToStream(pkcs7, in, inSz,
MAX_SEQ_SZ + MAX_VERSION_SZ + MAX_SEQ_SZ +
MAX_LENGTH_SZ + ASN_TAG_SZ + MAX_OID_SZ +
MAX_SEQ_SZ, &pkiMsg, &idx)) != 0) {
break;
}
pkiMsgSz = (pkcs7->stream->length > 0)? pkcs7->stream->length:
inSz;
totalSz = pkiMsgSz;
if (pkiMsg2 && pkiMsg2Sz > 0) {
totalSz += pkiMsg2Sz + pkcs7->contentSz;
}
if ((ret = wc_PKCS7_SetMaxStream(pkcs7, in, len)) != 0) {
break;
}
#endif
if (GetSequence_ex(pkiMsg, &idx, &length, pkiMsgSz,
NO_USER_CHECK) < 0)
return ASN_PARSE_E;
#else
ret = BER_INDEF_E;
#endif