j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed buffer overflow, and also NULL pointer dereference, in ECDSA signature handling.

Browse source
This commit is contained in:
Thomas Pornin 2016-11-21 20:11:21 +01:00
parent ccd43452e6
commit e8ccee8bcd
5 changed files with 80 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/ec/ecdsa_i31_vrfy_asn1.c
View file

@ -33,9 +33,13 @@ br_ecdsa_i31_vrfy_asn1(const br_ec_impl *impl,
const br_ec_public_key *pk,
const void *sig, size_t sig_len)
{
unsigned char rsig[(FIELD_LEN << 1) + 12];
/*
* We use a double-sized buffer because a malformed ASN.1 signature
* may trigger a size expansion when converting to "raw" format.
*/
unsigned char rsig[(FIELD_LEN << 2) + 24];
if (sig_len > sizeof rsig) {
if (sig_len > ((sizeof rsig) >> 1)) {
return 0;
}
memcpy(rsig, sig, sig_len);