mirrors-yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls synced 2024-11-24 19:18:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix potential integer overflow parsing DER CRT

Browse source 
This patch prevents a potential signed integer overflow during the
certificate version verification checks.
This commit is contained in:
Andres AG 2017-03-09 16:16:11 +00:00 committed by Simon Butcher
parent 7d97e669f0
commit 7ca4a03955
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog
View file

@ -228,6 +228,9 @@ Bugfix
digits. Found and fixed by Guido Vranken. digits. Found and fixed by Guido Vranken.
* Fix unlisted DES configuration dependency in some pkparse test cases. Found * Fix unlisted DES configuration dependency in some pkparse test cases. Found
by inestlerode. #555 by inestlerode. #555
* Fix a potential integer overflow in the version verification for DER
encoded X509 certificates. The overflow would enable maliciously
constructed certificates to bypass the certificate verification check.
= mbed TLS 2.4.1 branch released 2016-12-13 = mbed TLS 2.4.1 branch released 2016-12-13

6
library/x509_crt.c
View file

@ -748,14 +748,14 @@ static int x509_crt_parse_der_core( mbedtls_x509_crt *crt, const unsigned char *
return( ret ); return( ret );
} }
crt->version++; if( crt->version < 0 || crt->version > 2 )
if( crt->version > 3 )
{ {
mbedtls_x509_crt_free( crt ); mbedtls_x509_crt_free( crt );
return( MBEDTLS_ERR_X509_UNKNOWN_VERSION ); return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
} }
crt->version++;
if( ( ret = mbedtls_x509_get_sig_alg( &crt->sig_oid, &sig_params1, if( ( ret = mbedtls_x509_get_sig_alg( &crt->sig_oid, &sig_params1,
&crt->sig_md, &crt->sig_pk, &crt->sig_md, &crt->sig_pk,
&crt->sig_opts ) ) != 0 ) &crt->sig_opts ) ) != 0 )