From 32f9250f554f0962dd3dce5496156b8c315715ca Mon Sep 17 00:00:00 2001
From: guenther <>
Date: Sun, 2 Oct 2016 20:45:04 +0000
Subject: In X509_cmp_time(), pass asn1_time_parse() the tag of the field being
 parsed so that a malformed GeneralizedTime field is recognized as an error
 instead of potentially being interpreted as if it was a valid UTCTime.

Reported by Theofilos Petsios (theofilos (at) cs.columbia.edu)

ok beck@ tedu@ jsing@
---
 src/lib/libcrypto/x509/x509_vfy.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 5c043aa7b1..a9330e1c03 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.49 2016/03/11 07:08:45 mmcc Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.50 2016/10/02 20:45:04 guenther Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1658,7 +1658,8 @@ X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
 
 	memset(&tm1, 0, sizeof(tm1));
 
-	if ((type = asn1_time_parse(ctm->data, ctm->length, &tm1, 0)) == -1)
+	type = asn1_time_parse(ctm->data, ctm->length, &tm1, ctm->type);
+	if (type == -1)
 		goto out; /* invalid time */
 
 	/* RFC 5280 section 4.1.2.5 */
-- 
cgit v1.2.3-55-g6feb