diff options
| author | tb <> | 2026-06-09 12:29:47 +0000 |
|---|---|---|
| committer | tb <> | 2026-06-09 12:29:47 +0000 |
| commit | 329187ca76781997d3a01eafa23caac7f93779f7 (patch) | |
| tree | 0668d9b6df43809007da7636c70b7dc4dd1741f2 /src/lib/libssl/tls_buffer.c | |
| parent | 256315fc6aeff5ec985bfee63fae84e6cafc4555 (diff) | |
| download | openbsd-329187ca76781997d3a01eafa23caac7f93779f7.tar.gz openbsd-329187ca76781997d3a01eafa23caac7f93779f7.tar.bz2 openbsd-329187ca76781997d3a01eafa23caac7f93779f7.zip | |
Add some missing bounds checks to ASN1_mbstring_copy()
If the in string is unreasonably long, assigning strlen(in) to an int
may overflow, so exclude this situation.
Moreover, the code would unconditionally multiply nchar by 2 or 4,
which could again overflow an int. Check for this situation and error
out to avoid an out of bounds write.
More may be needed in here, which will be revisited later.
Based on a diff by Viktor Dukhovni via OpenSSL.
Diffstat (limited to 'src/lib/libssl/tls_buffer.c')
0 files changed, 0 insertions, 0 deletions