lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Fix integer overflow with an input buffer larger than INT_MAX

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
2023-09-21 16:50:40 +02:00
parent aa01a038b5
commit 7077781af5
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
library/x509_create.c
View File

@ -208,7 +208,7 @@ static int parse_attribute_value_string(const char *s,
* contains a null byte. * contains a null byte.
*/ */
static int parse_attribute_value_hex_der_encoded(const char *s, static int parse_attribute_value_hex_der_encoded(const char *s,
int len, size_t len,
unsigned char *data, unsigned char *data,
size_t *data_len, size_t *data_len,
int *tag) int *tag)
@ -308,10 +308,12 @@ int mbedtls_x509_string_to_names(mbedtls_asn1_named_data **head, const char *nam
mbedtls_free(oid.p); mbedtls_free(oid.p);
return MBEDTLS_ERR_X509_INVALID_NAME; return MBEDTLS_ERR_X509_INVALID_NAME;
} else if (*s == '#') { } else if (*s == '#') {
if ((parse_ret = /* We know that c >= s (loop invariant) and c != s (in this
parse_attribute_value_hex_der_encoded(s + 1, (int) (c - s - 1), * else branch), hence c - s - 1 >= 0. */
data, &data_len, parse_ret = parse_attribute_value_hex_der_encoded(
&tag)) != 0) { s + 1, c - s - 1,
data, &data_len, &tag);
if (parse_ret != 0) {
mbedtls_free(oid.p); mbedtls_free(oid.p);
return MBEDTLS_ERR_X509_INVALID_NAME; return MBEDTLS_ERR_X509_INVALID_NAME;
} }