mirror of
				https://github.com/Mbed-TLS/mbedtls.git
				synced 2025-11-03 20:33:16 +03:00 
			
		
		
		
	Fix possible UB in mbedtls_asn1_write_raw_buffer()
This is mostly unrelated to other commits in this PR, except for the fact that one of the added X.509 tests revealed that with UBSan. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
		
							
								
								
									
										5
									
								
								ChangeLog.d/fix-asn1write-raw-buffer.txt
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										5
									
								
								ChangeLog.d/fix-asn1write-raw-buffer.txt
									
									
									
									
									
										Normal file
									
								
							@@ -0,0 +1,5 @@
 | 
				
			|||||||
 | 
					Bugfix
 | 
				
			||||||
 | 
					   * When calling mbedtls_asn1_write_raw_buffer() with NULL, 0 as the last two
 | 
				
			||||||
 | 
					     arguments, undefined behaviour would be triggered, in the form of a call to
 | 
				
			||||||
 | 
					     memcpy(..., NULL, 0). This was harmless in practice, but could trigger
 | 
				
			||||||
 | 
					     complains from sanitizers or static analyzers.
 | 
				
			||||||
@@ -90,7 +90,9 @@ int mbedtls_asn1_write_raw_buffer(unsigned char **p, const unsigned char *start,
 | 
				
			|||||||
 | 
					
 | 
				
			||||||
    len = size;
 | 
					    len = size;
 | 
				
			||||||
    (*p) -= len;
 | 
					    (*p) -= len;
 | 
				
			||||||
 | 
					    if (len != 0) {
 | 
				
			||||||
        memcpy(*p, buf, len);
 | 
					        memcpy(*p, buf, len);
 | 
				
			||||||
 | 
					    }
 | 
				
			||||||
 | 
					
 | 
				
			||||||
    return (int) len;
 | 
					    return (int) len;
 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 
 | 
				
			|||||||
		Reference in New Issue
	
	Block a user