bound notBeforeDataEnd with origSz

2026-07-06 20:00:51 +02:00 · 2026-04-03 17:12:27 -06:00
parent 0c9b6397be
commit f59d50f18a
1 changed files with 3 additions and 0 deletions
@@ -502,6 +502,9 @@ static int craft_malicious_time_cert(const byte* orig, int origSz,

    notBeforeLenOff = validityOff + 3; /* the 0x0D byte */
    notBeforeDataEnd = notBeforeLenOff + 1 + 13; /* tag(1) was at +2, data starts at +4 */
+    if (notBeforeDataEnd >= origSz) {
+        return -1;
+    }

    /* Build the new buffer:
     *   [0 .. notBeforeLenOff-1]  unchanged prefix