Fix a NULL dereference in GENERAL_NAME_cmp()libressl-v3.1.5OPENBSD_6_7

Comparing two GENERAL_NAME structures containing an EDIPARTYNAME can lead
to a crash. This enables a denial of service attack for an attacker who can
control both sides of the comparison.

Issue reported to OpenSSL on Nov 9 by David Benjamin.
OpenSSL shared the information with us on Dec 1st.
Fix from Matt Caswell (OpenSSL) with a few small tweaks.

ok jsing

this is errata/6.7/031_asn1.patch.sig

1 files changed, 2 insertions, 1 deletions

diff --git a/src/lib/libcrypto/asn1/asn1_err.c b/src/lib/libcrypto/asn1/asn1_err.c
index 5cc355084f..bfa9fbf0b5 100644
--- a/src/lib/libcrypto/asn1/asn1_err.c
+++ b/src/lib/libcrypto/asn1/asn1_err.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_err.c,v 1.21 2018/03/29 02:29:24 inoguchi Exp $ */
+/* $OpenBSD: asn1_err.c,v 1.21.8.1 2020/12/08 15:10:03 tb Exp $ */
 /* ====================================================================
  * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
@@ -85,6 +85,7 @@ static ERR_STRING_DATA ASN1_str_reasons[] = {
         {ERR_REASON(ASN1_R_BAD_OBJECT_HEADER)    , "bad object header"},
         {ERR_REASON(ASN1_R_BAD_PASSWORD_READ)    , "bad password read"},
         {ERR_REASON(ASN1_R_BAD_TAG)              , "bad tag"},
+        {ERR_REASON(ASN1_R_BAD_TEMPLATE)         , "bad template"},
         {ERR_REASON(ASN1_R_BMPSTRING_IS_WRONG_LENGTH), "bmpstring is wrong length"},
         {ERR_REASON(ASN1_R_BN_LIB)               , "bn lib"},
         {ERR_REASON(ASN1_R_BOOLEAN_IS_WRONG_LENGTH), "boolean is wrong length"},