diff options
| author | Tomas Mraz <tomas@openssl.org> | 2024-07-18 10:48:58 +0200 |
|---|---|---|
| committer | Todd Short <todd.short@me.com> | 2024-07-21 12:32:39 -0400 |
| commit | 5d44130278a693e332bdc09936c79e1e7cbce2c7 (patch) | |
| tree | 564bd8d53d38f3afa23748019b9ca5945211fbd4 | |
| parent | a2bc3dfdd728feda1af09a56a95961bb0e90dca7 (diff) | |
| download | openssl-5d44130278a693e332bdc09936c79e1e7cbce2c7.zip openssl-5d44130278a693e332bdc09936c79e1e7cbce2c7.tar.gz openssl-5d44130278a693e332bdc09936c79e1e7cbce2c7.tar.bz2 | |
i2d_name_canon(): Check overflow in len accumulation
Fixes Coverity 1604638
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/24930)
(cherry picked from commit b2deefb9d262f0f9eae6964006df98c2fa24daac)
(cherry picked from commit dd744cd19b3ff2bdc320c8a77b5c32ff543eaeb3)
(cherry picked from commit a3bfc4fd5b5641b05d6611073146627cf9114436)
| -rw-r--r-- | crypto/x509/x_name.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/crypto/x509/x_name.c b/crypto/x509/x_name.c index 944eb99..5d3a4f9 100644 --- a/crypto/x509/x_name.c +++ b/crypto/x509/x_name.c @@ -476,8 +476,8 @@ static int i2d_name_canon(const STACK_OF(STACK_OF_X509_NAME_ENTRY) * _intname, v = sk_ASN1_VALUE_value(intname, i); ltmp = ASN1_item_ex_i2d(&v, in, ASN1_ITEM_rptr(X509_NAME_ENTRIES), -1, -1); - if (ltmp < 0) - return ltmp; + if (ltmp < 0 || len > INT_MAX - ltmp) + return -1; len += ltmp; } return len; |