Fix various read buffer overflow when printing ASN.1 strings (which are

not necessarily NUL terminated). Same as schwarze's fix in t_x509a.c r1.9.

From David Benjamin and Matt Caswell (part of the fixes in OpenSSL 1.1.1l)

ok inoguchi

4 files changed, 20 insertions, 14 deletions

diff --git a/src/lib/libcrypto/asn1/t_spki.c b/src/lib/libcrypto/asn1/t_spki.c
index 39ff0670b6..7f1ed129cf 100644
--- a/src/lib/libcrypto/asn1/t_spki.c
+++ b/src/lib/libcrypto/asn1/t_spki.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_spki.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: t_spki.c,v 1.12 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -94,7 +94,8 @@ NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
         }
         chal = spki->spkac->challenge;
         if (chal->length)
-                BIO_printf(out, "  Challenge String: %s\n", chal->data);
+                BIO_printf(out, "  Challenge String: %.*s\n", chal->length,
+                    chal->data);
         i = OBJ_obj2nid(spki->sig_algor->algorithm);
         BIO_printf(out, "  Signature Algorithm: %s",
             (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
diff --git a/src/lib/libcrypto/x509/x509_alt.c b/src/lib/libcrypto/x509/x509_alt.c
index 45aaec24c0..5b9f490bae 100644
--- a/src/lib/libcrypto/x509/x509_alt.c
+++ b/src/lib/libcrypto/x509/x509_alt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_alt.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_alt.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -264,15 +264,18 @@ GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
                 break;
 
         case GEN_EMAIL:
-                BIO_printf(out, "email:%s", gen->d.ia5->data);
+                BIO_printf(out, "email:%.*s", gen->d.ia5->length,
+                    gen->d.ia5->data);
                 break;
 
         case GEN_DNS:
-                BIO_printf(out, "DNS:%s", gen->d.ia5->data);
+                BIO_printf(out, "DNS:%.*s", gen->d.ia5->length,
+                    gen->d.ia5->data);
                 break;
 
         case GEN_URI:
-                BIO_printf(out, "URI:%s", gen->d.ia5->data);
+                BIO_printf(out, "URI:%.*s", gen->d.ia5->length,
+                    gen->d.ia5->data);
                 break;
 
         case GEN_DIRNAME:
diff --git a/src/lib/libcrypto/x509/x509_cpols.c b/src/lib/libcrypto/x509/x509_cpols.c
index 4b6c13cfbe..2ace607b23 100644
--- a/src/lib/libcrypto/x509/x509_cpols.c
+++ b/src/lib/libcrypto/x509/x509_cpols.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_cpols.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_cpols.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -696,7 +696,8 @@ print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals, int indent)
                 qualinfo = sk_POLICYQUALINFO_value(quals, i);
                 switch (OBJ_obj2nid(qualinfo->pqualid)) {
                 case NID_id_qt_cps:
-                        BIO_printf(out, "%*sCPS: %s\n", indent, "",
+                        BIO_printf(out, "%*sCPS: %.*s\n", indent, "",
+                            qualinfo->d.cpsuri->length,
                             qualinfo->d.cpsuri->data);
                         break;
 
@@ -724,8 +725,8 @@ print_notice(BIO *out, USERNOTICE *notice, int indent)
         if (notice->noticeref) {
                 NOTICEREF *ref;
                 ref = notice->noticeref;
-                BIO_printf(out, "%*sOrganization: %s\n", indent, "",
-                    ref->organization->data);
+                BIO_printf(out, "%*sOrganization: %.*s\n", indent, "",
+                    ref->organization->length, ref->organization->data);
                 BIO_printf(out, "%*sNumber%s: ", indent, "",
                     sk_ASN1_INTEGER_num(ref->noticenos) > 1 ? "s" : "");
                 for (i = 0; i < sk_ASN1_INTEGER_num(ref->noticenos); i++) {
@@ -741,8 +742,8 @@ print_notice(BIO *out, USERNOTICE *notice, int indent)
                 BIO_puts(out, "\n");
         }
         if (notice->exptext)
-                BIO_printf(out, "%*sExplicit Text: %s\n", indent, "",
-                    notice->exptext->data);
+                BIO_printf(out, "%*sExplicit Text: %.*s\n", indent, "",
+                    notice->exptext->length, notice->exptext->data);
 }
 
 void
diff --git a/src/lib/libcrypto/x509/x509_pci.c b/src/lib/libcrypto/x509/x509_pci.c
index 8997f0cec8..b1d31dfb44 100644
--- a/src/lib/libcrypto/x509/x509_pci.c
+++ b/src/lib/libcrypto/x509/x509_pci.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_pci.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_pci.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Contributed to the OpenSSL Project 2004
  * by Richard Levitte (richard@levitte.org)
  */
@@ -77,7 +77,8 @@ i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci, BIO *out,
         i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
         BIO_puts(out, "\n");
         if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
-                BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
+                BIO_printf(out, "%*sPolicy Text: %.*s\n", indent, "",
+                    pci->proxyPolicy->policy->length,
                     pci->proxyPolicy->policy->data);
         return 1;
 }