From d0cf9aeca512581235a63d9ed8e8a3c69039b9df Mon Sep 17 00:00:00 2001 From: schwarze <> Date: Thu, 4 Jun 2020 21:21:03 +0000 Subject: When X509_ATTRIBUTE_create() receives an invalid NID (e.g., -1), return failure rather than silently constructing a broken X509_ATTRIBUTE object that might cause NULL pointer accesses later on. This matters because X509_ATTRIBUTE_create() is used by documented API functions like PKCS7_add_attribute(3) and the NID comes straight from the user. This fixes a bug found while working on documentation. OK tb@ and "thanks" bluhm@ --- src/lib/libcrypto/man/PKCS7_add_attribute.3 | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) (limited to 'src/lib/libcrypto/man') diff --git a/src/lib/libcrypto/man/PKCS7_add_attribute.3 b/src/lib/libcrypto/man/PKCS7_add_attribute.3 index 09c36a4d5d..081703f0f3 100644 --- a/src/lib/libcrypto/man/PKCS7_add_attribute.3 +++ b/src/lib/libcrypto/man/PKCS7_add_attribute.3 @@ -1,4 +1,4 @@ -.\" $OpenBSD: PKCS7_add_attribute.3,v 1.1 2020/06/04 10:24:27 schwarze Exp $ +.\" $OpenBSD: PKCS7_add_attribute.3,v 1.2 2020/06/04 21:21:03 schwarze Exp $ .\" .\" Copyright (c) 2020 Ingo Schwarze .\" @@ -123,7 +123,9 @@ exist. and .Fn PKCS7_add_signed_attribute return 1 on success or 0 on failure. -The most common reason for failure is lack of memory. +The most common reasons for failure are an invalid +.Fa nid +argument or lack of memory. .Pp .Fn PKCS7_get_attribute and @@ -153,16 +155,6 @@ These functions first appeared in OpenSSL 0.9.1 and have been available since .Ox 2.6 . .Sh BUGS -Adding an attribute with an invalid -.Fa nid -ought to fail, but it actually succeeds -setting the type of the new attribute to -.Dv NULL . -Subsequent attempts to retrieve attributes -may cause the program to crash due to -.Dv NULL -pointer access. -.Pp A function to remove individual attributes from these lists does not appear to exist. A program desiring to do that might have to manually iterate the fields -- cgit v1.2.3-55-g6feb