diff options
| author | inoguchi <> | 2022-01-14 23:55:46 +0000 |
|---|---|---|
| committer | inoguchi <> | 2022-01-14 23:55:46 +0000 |
| commit | d00af36e612a46a6acda87f7b192bd40352e4df2 (patch) | |
| tree | 033ed9076d9786371759261ed6d2b66d6c5e43eb /src/lib/libtls/tls_server.c | |
| parent | 4d6ecef5cde1993d152ea7386898945d1e5050e9 (diff) | |
| download | openbsd-d00af36e612a46a6acda87f7b192bd40352e4df2.tar.gz openbsd-d00af36e612a46a6acda87f7b192bd40352e4df2.tar.bz2 openbsd-d00af36e612a46a6acda87f7b192bd40352e4df2.zip | |
Avoid buffer overflow in asn1_parse2
asn1_par.c r1.29 changed to access p[0] directly, and this pointer could be
overrun since ASN1_get_object advances pointer to the first content octet.
In case invalid ASN1 Boolean data, it has length but no content, I thought
this could be happen.
Adding check p with tot (diff below) will avoid this failure.
Reported by oss-fuzz 43633 and 43648(later)
ok tb@
Diffstat (limited to 'src/lib/libtls/tls_server.c')
0 files changed, 0 insertions, 0 deletions