1 files changed, 9 insertions, 5 deletions

diff --git a/src/lib/libcrypto/asn1/a_strex.c b/src/lib/libcrypto/asn1/a_strex.c
index 7ddb7662f1..1def6c6549 100644
--- a/src/lib/libcrypto/asn1/a_strex.c
+++ b/src/lib/libcrypto/asn1/a_strex.c
@@ -63,6 +63,7 @@
 #include <openssl/asn1.h>
 
 #include "charmap.h"
+#include "cryptlib.h"
 
 /* ASN1_STRING_print_ex() and X509_NAME_print_ex().
  * Enhanced string and name printing routines handling
@@ -114,14 +115,17 @@ typedef int char_io(void *arg, const void *buf, int len);
 static int do_esc_char(unsigned long c, unsigned char flags, char *do_quotes, char_io *io_ch, void *arg)
 {
         unsigned char chflgs, chtmp;
-        char tmphex[11];
+        char tmphex[HEX_SIZE(long)+3];
+
+        if(c > 0xffffffffL)
+                return -1;
         if(c > 0xffff) {
-                BIO_snprintf(tmphex, 11, "\\W%08lX", c);
+                BIO_snprintf(tmphex, sizeof tmphex, "\\W%08lX", c);
                 if(!io_ch(arg, tmphex, 10)) return -1;
                 return 10;
         }
         if(c > 0xff) {
-                BIO_snprintf(tmphex, 11, "\\U%04lX", c);
+                BIO_snprintf(tmphex, sizeof tmphex, "\\U%04lX", c);
                 if(!io_ch(arg, tmphex, 6)) return -1;
                 return 6;
         }
@@ -195,7 +199,7 @@ static int do_buf(unsigned char *buf, int buflen,
                 if(type & BUF_TYPE_CONVUTF8) {
                         unsigned char utfbuf[6];
                         int utflen;
-                        utflen = UTF8_putc(utfbuf, 6, c);
+                        utflen = UTF8_putc(utfbuf, sizeof utfbuf, c);
                         for(i = 0; i < utflen; i++) {
                                 /* We don't need to worry about setting orflags correctly
                                  * because if utflen==1 its value will be correct anyway 
@@ -461,7 +465,7 @@ static int do_name_ex(char_io *io_ch, void *arg, X509_NAME *n,
                 if(fn_opt != XN_FLAG_FN_NONE) {
                         int objlen, fld_len;
                         if((fn_opt == XN_FLAG_FN_OID) || (fn_nid==NID_undef) ) {
-                                OBJ_obj2txt(objtmp, 80, fn, 1);
+                                OBJ_obj2txt(objtmp, sizeof objtmp, fn, 1);
                                 fld_len = 0; /* XXX: what should this be? */
                                 objbuf = objtmp;
                         } else {