Merge pull request #10788 from aidangarske/fenrir-tls-batch-2026-06

Various hardening fixes across sniffer, QUIC, PKCS#11, TLS and tooling
This commit is contained in:
David Garske
2026-07-08 13:58:14 -07:00
committed by GitHub
11 changed files with 138 additions and 27 deletions
+8 -1
View File
@@ -98,13 +98,20 @@ static int asn1App_ReadFile(FILE* fp, unsigned char** pdata, word32* plen)
/* Add read data amount to length. */
len += (word32)read_len;
/* Stop before the length or reallocation size can wrap word32. */
if (len > (word32)(0xFFFFFFFFU - DATA_INC_LEN)) {
XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
data = NULL;
break;
}
/* Stop if we are at end-of-file. */
if (feof(fp)) {
break;
}
/* Make space for more data to be added to buffer. */
p = (unsigned char*)XREALLOC(data, len + DATA_INC_LEN, NULL,
p = (unsigned char*)XREALLOC(data, (size_t)len + DATA_INC_LEN, NULL,
DYNAMIC_TYPE_TMP_BUFFER);
if (p == NULL) {
/* Reallocation failed - free current buffer. */
+8 -1
View File
@@ -112,13 +112,20 @@ static int pemApp_ReadFile(FILE* fp, unsigned char** pdata, word32* plen)
/* Add read data amount to length. */
len += (word32)read_len;
/* Stop before the length or reallocation size can wrap word32. */
if (len > (word32)(0xFFFFFFFFU - DATA_INC_LEN - BLOCK_SIZE_MAX)) {
XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
data = NULL;
break;
}
/* Stop if we are at end-of-file. */
if (feof(fp)) {
break;
}
/* Make space for more data to be added to buffer. */
p = (unsigned char*)XREALLOC(data, len + DATA_INC_LEN +
p = (unsigned char*)XREALLOC(data, (size_t)len + DATA_INC_LEN +
BLOCK_SIZE_MAX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
if (p == NULL) {
/* Reallocation failed - free current buffer. */