j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed buffer overflow in private key decoding (wrong buffer length used in size check).

Browse source
This commit is contained in:
Thomas Pornin 2019-07-20 10:36:36 -04:00
parent 2893441f2e
commit b715b43e41
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/x509/skey_decoder.c
View file

@ -155,7 +155,7 @@ static const unsigned char t0_codeblock[] = {
0x02, 0x06, 0x1E, 0x00, 0x00, 0x19, 0x19, 0x00, 0x00, 0x01, 0x0B, 0x00, 0x02, 0x06, 0x1E, 0x00, 0x00, 0x19, 0x19, 0x00, 0x00, 0x01, 0x0B, 0x00,
0x00, 0x01, 0x00, 0x20, 0x14, 0x06, 0x08, 0x01, 0x01, 0x21, 0x20, 0x22, 0x00, 0x01, 0x00, 0x20, 0x14, 0x06, 0x08, 0x01, 0x01, 0x21, 0x20, 0x22,
0x20, 0x04, 0x75, 0x13, 0x00, 0x00, 0x01, 0x20, 0x04, 0x75, 0x13, 0x00, 0x00, 0x01,
T0_INT2(3 * BR_X509_BUFSIZE_KEY), 0x00, 0x01, 0x01, 0x87, 0xFF, 0xFF, T0_INT2(3 * BR_X509_BUFSIZE_SIG), 0x00, 0x01, 0x01, 0x87, 0xFF, 0xFF,
0x7F, 0x54, 0x57, 0x01, 0x02, 0x3E, 0x55, 0x01, 0x01, 0x0E, 0x06, 0x02, 0x7F, 0x54, 0x57, 0x01, 0x02, 0x3E, 0x55, 0x01, 0x01, 0x0E, 0x06, 0x02,
0x30, 0x16, 0x57, 0x01, 0x02, 0x19, 0x0D, 0x06, 0x06, 0x13, 0x3B, 0x44, 0x30, 0x16, 0x57, 0x01, 0x02, 0x19, 0x0D, 0x06, 0x06, 0x13, 0x3B, 0x44,
0x32, 0x04, 0x1C, 0x01, 0x04, 0x19, 0x0D, 0x06, 0x08, 0x13, 0x3B, 0x01, 0x32, 0x04, 0x1C, 0x01, 0x04, 0x19, 0x0D, 0x06, 0x08, 0x13, 0x3B, 0x01,

2
src/x509/skey_decoder.t0
View file

@ -80,7 +80,7 @@ cc: read-blob-inner ( addr len -- addr len ) {
\ Get the length of the key_data buffer. \ Get the length of the key_data buffer.
: len-key_data : len-key_data
CX 0 8191 { 3 * BR_X509_BUFSIZE_KEY } ; CX 0 8191 { 3 * BR_X509_BUFSIZE_SIG } ;
\ Get the address and length for the key_data buffer. \ Get the address and length for the key_data buffer.
: addr-len-key_data ( -- addr len ) : addr-len-key_data ( -- addr len )