提交 61b0fead 编写于 作者: M Matt Caswell

Don't Overflow when printing Thawte Strong Extranet Version

When printing human readable info on the Thawte Strong Extranet extension
the version number could overflow if the version number == LONG_MAX. This
is undefined behaviour.

Issue found by OSSFuzz.
Reviewed-by: NBen Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/13452)
上级 89cccbea
......@@ -57,12 +57,24 @@ IMPLEMENT_ASN1_FUNCTIONS(SXNET)
static int sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out,
int indent)
{
long v;
int64_t v;
char *tmp;
SXNETID *id;
int i;
v = ASN1_INTEGER_get(sx->version);
BIO_printf(out, "%*sVersion: %ld (0x%lX)", indent, "", v + 1, v);
/*
* Since we add 1 to the version number to display it, we don't support
* LONG_MAX since that would cause on overflow.
*/
if (!ASN1_INTEGER_get_int64(&v, sx->version)
|| v >= LONG_MAX
|| v < LONG_MIN) {
BIO_printf(out, "%*sVersion: <unsupported>", indent, "");
} else {
long vl = (long)v;
BIO_printf(out, "%*sVersion: %ld (0x%lX)", indent, "", vl + 1, vl);
}
for (i = 0; i < sk_SXNETID_num(sx->ids); i++) {
id = sk_SXNETID_value(sx->ids, i);
tmp = i2s_ASN1_INTEGER(NULL, id->zone);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册