From d0a893e8e1ffc5aeba0c0a26575d32e25cbf2e17 Mon Sep 17 00:00:00 2001 From: jsing <> Date: Thu, 23 Sep 2021 15:49:48 +0000 Subject: Avoid a potential overread in x509_constraints_parse_mailbox() The length checks need to be >= rather than > in order to ensure the string remains NUL terminated. While here consistently check wi before using it so we have the same idiom throughout this function. Issue reported by GoldBinocle on GitHub. ok deraadt@ tb@ --- src/lib/libcrypto/x509/x509_constraints.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) (limited to 'src/lib/libcrypto') diff --git a/src/lib/libcrypto/x509/x509_constraints.c b/src/lib/libcrypto/x509/x509_constraints.c index fade58c620..db33bf1aa4 100644 --- a/src/lib/libcrypto/x509/x509_constraints.c +++ b/src/lib/libcrypto/x509/x509_constraints.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509_constraints.c,v 1.16 2021/04/27 03:35:29 beck Exp $ */ +/* $OpenBSD: x509_constraints.c,v 1.17 2021/09/23 15:49:48 jsing Exp $ */ /* * Copyright (c) 2020 Bob Beck * @@ -339,16 +339,16 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, if (c == '.') goto bad; } - if (wi > DOMAIN_PART_MAX_LEN) - goto bad; if (accept) { + if (wi >= DOMAIN_PART_MAX_LEN) + goto bad; working[wi++] = c; accept = 0; continue; } if (candidate_local != NULL) { /* We are looking for the domain part */ - if (wi > DOMAIN_PART_MAX_LEN) + if (wi >= DOMAIN_PART_MAX_LEN) goto bad; working[wi++] = c; if (i == len - 1) { @@ -363,7 +363,7 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, continue; } /* We are looking for the local part */ - if (wi > LOCAL_PART_MAX_LEN) + if (wi >= LOCAL_PART_MAX_LEN) break; if (quoted) { @@ -383,6 +383,8 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, */ if (c == 9) goto bad; + if (wi >= LOCAL_PART_MAX_LEN) + goto bad; working[wi++] = c; continue; /* all's good inside our quoted string */ } @@ -412,6 +414,8 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, } if (!local_part_ok(c)) goto bad; + if (wi >= LOCAL_PART_MAX_LEN) + goto bad; working[wi++] = c; } if (candidate_local == NULL || candidate_domain == NULL) -- cgit v1.2.3-55-g6feb