Fix various read buffer overflow when printing ASN.1 strings (which are

not necessarily NUL terminated). Same as schwarze's fix in t_x509a.c r1.9.

From David Benjamin and Matt Caswell (part of the fixes in OpenSSL 1.1.1l)

ok inoguchi

1 files changed, 3 insertions, 2 deletions

diff --git a/src/lib/libcrypto/asn1/t_spki.c b/src/lib/libcrypto/asn1/t_spki.c
index 39ff0670b6..7f1ed129cf 100644
--- a/src/lib/libcrypto/asn1/t_spki.c
+++ b/src/lib/libcrypto/asn1/t_spki.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_spki.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: t_spki.c,v 1.12 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -94,7 +94,8 @@ NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
         }
         chal = spki->spkac->challenge;
         if (chal->length)
-                BIO_printf(out, "  Challenge String: %s\n", chal->data);
+                BIO_printf(out, "  Challenge String: %.*s\n", chal->length,
+                    chal->data);
         i = OBJ_obj2nid(spki->sig_algor->algorithm);
         BIO_printf(out, "  Signature Algorithm: %s",
             (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));