diff options
author | Manuel Pégourié-Gonnard <mpg2@elzevir.fr> | 2015-10-02 11:16:47 +0200 |
---|---|---|
committer | Manuel Pégourié-Gonnard <mpg2@elzevir.fr> | 2015-10-02 12:36:02 +0200 |
commit | d64f1ad98b40417d583b80e23b646737cf086dcf (patch) | |
tree | 9719d6c4c8784d49e69a7809851d8b04bcb23437 | |
parent | 9a656a0aaa2ee184fc59a2a4dd1dcf6d1d536c43 (diff) | |
download | mbedtls-d64f1ad98b40417d583b80e23b646737cf086dcf.zip mbedtls-d64f1ad98b40417d583b80e23b646737cf086dcf.tar.gz mbedtls-d64f1ad98b40417d583b80e23b646737cf086dcf.tar.bz2 |
Fix potential overflow in CertificateRequest
-rw-r--r-- | ChangeLog | 4 | ||||
-rw-r--r-- | library/ssl_srv.c | 9 |
2 files changed, 11 insertions, 2 deletions
@@ -18,6 +18,10 @@ Security * Fix possible heap buffer overflow in base64_encode() when the input buffer is 512MB or larger on 32-bit platforms. Found by Guido Vranken. Not trigerrable remotely in TLS. + * Fix potential heap buffer overflow in servers that perform client + authentication against a crafted CA cert. Cannot be triggered remotely + unless you allow third parties to pick trust CAs for client auth. + Found by Guido Vranken. = Version 1.2.16 released 2015-09-17 diff --git a/library/ssl_srv.c b/library/ssl_srv.c index cd9802a..2f4ae69 100644 --- a/library/ssl_srv.c +++ b/library/ssl_srv.c @@ -923,6 +923,7 @@ static int ssl_write_certificate_request( ssl_context *ssl ) size_t n = 0, dn_size, total_dn_size; unsigned char *buf, *p; const x509_cert *crt; + const unsigned char * const end = ssl->out_msg + SSL_MAX_CONTENT_LEN; SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); @@ -987,10 +988,14 @@ static int ssl_write_certificate_request( ssl_context *ssl ) total_dn_size = 0; while( crt != NULL && crt->version != 0) { - if( p - buf > 4096 ) + dn_size = crt->subject_raw.len; + + if( end < p || (size_t)( end - p ) < 2 + dn_size ) + { + SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) ); break; + } - dn_size = crt->subject_raw.len; *p++ = (unsigned char)( dn_size >> 8 ); *p++ = (unsigned char)( dn_size ); memcpy( p, crt->subject_raw.p, dn_size ); |