wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-02 12:14:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix a heap buffer overflow with mismatched PEM structure ZD13097

Browse Source
This commit is contained in:
Juliusz Sosinowicz
2021-11-02 11:31:22 +01:00
parent 2745f394e5
commit 23487a4532
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/ssl.c
View File

@@ -43737,7 +43737,7 @@ err:
} }
/* Read the header and footer */ /* Read the header and footer */
while (wolfSSL_BIO_read(bio, &pem[i], 1) == 1) { while (i < l && wolfSSL_BIO_read(bio, &pem[i], 1) == 1) {
i++; i++;
if (!header) { if (!header) {
header = XSTRNSTR(pem, "-----BEGIN ", (unsigned int)i); header = XSTRNSTR(pem, "-----BEGIN ", (unsigned int)i);
@@ -43769,7 +43769,9 @@ err:
if (footerEnd) { if (footerEnd) {
footerEnd += XSTR_SIZEOF("-----"); footerEnd += XSTR_SIZEOF("-----");
/* Now check that footer matches header */ /* Now check that footer matches header */
if (XMEMCMP(header + XSTR_SIZEOF("-----BEGIN "), if ((headerEnd - (header + XSTR_SIZEOF("-----BEGIN "))) ==
(footerEnd - (footer + XSTR_SIZEOF("-----END "))) &&
XMEMCMP(header + XSTR_SIZEOF("-----BEGIN "),
footer + XSTR_SIZEOF("-----END "), footer + XSTR_SIZEOF("-----END "),
headerEnd - (header + XSTR_SIZEOF("-----BEGIN "))) headerEnd - (header + XSTR_SIZEOF("-----BEGIN ")))
!= 0) { != 0) {

12
tests/api.c
View File

@@ -29683,6 +29683,11 @@ static void test_wolfSSL_X509_INFO(void)
X509_INFO *info; X509_INFO *info;
BIO *cert; BIO *cert;
int i; int i;
byte data[] = {
"---------BEGIN CERTc-----\n"
"MIIDMTBuQ=\n"
"-----END -----"
};
printf(testingFmt, "wolfSSL_X509_INFO"); printf(testingFmt, "wolfSSL_X509_INFO");
@@ -29701,6 +29706,13 @@ static void test_wolfSSL_X509_INFO(void)
sk_X509_INFO_free(info_stack); sk_X509_INFO_free(info_stack);
BIO_free(cert); BIO_free(cert);
/* This case should fail due to invalid input. */
AssertNotNull(cert = BIO_new(BIO_s_mem()));
AssertIntEQ(BIO_write(cert, data, sizeof(data)), sizeof(data));
AssertNull(info_stack = PEM_X509_INFO_read_bio(cert, NULL, NULL, NULL));
sk_X509_INFO_pop_free(info_stack, X509_INFO_free);
BIO_free(cert);
printf(resultFmt, passed); printf(resultFmt, passed);
#endif #endif
} }