1. 21 5月, 2016 16 次提交
  2. 20 5月, 2016 5 次提交
  3. 17 5月, 2016 1 次提交
  4. 12 5月, 2016 1 次提交
    • D
      KEYS: Fix ASN.1 indefinite length object parsing · 23c8a812
      David Howells 提交于
      This fixes CVE-2016-0758.
      
      In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
      it isn't validated against the remaining amount of data before being added
      to the cursor.  With a sufficiently large size indicated, the check:
      
      	datalen - dp < 2
      
      may then fail due to integer overflow.
      
      Fix this by checking the length indicated against the amount of remaining
      data in both places a definite length is determined.
      
      Whilst we're at it, make the following changes:
      
       (1) Check the maximum size of extended length does not exceed the capacity
           of the variable it's being stored in (len) rather than the type that
           variable is assumed to be (size_t).
      
       (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
           integer 0.
      
       (3) To reduce confusion, move the initialisation of len outside of:
      
      	for (len = 0; n > 0; n--) {
      
           since it doesn't have anything to do with the loop counter n.
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Reviewed-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      Acked-by: NDavid Woodhouse <David.Woodhouse@intel.com>
      Acked-by: NPeter Jones <pjones@redhat.com>
      23c8a812
  5. 10 5月, 2016 1 次提交
  6. 06 5月, 2016 1 次提交
  7. 03 5月, 2016 1 次提交
  8. 29 4月, 2016 1 次提交
  9. 24 4月, 2016 1 次提交
  10. 22 4月, 2016 1 次提交
  11. 21 4月, 2016 3 次提交
  12. 16 4月, 2016 1 次提交
  13. 14 4月, 2016 2 次提交
  14. 09 4月, 2016 1 次提交
  15. 07 4月, 2016 4 次提交