diff options
| author | Tomas Mraz <tomas@openssl.org> | 2024-08-05 14:49:52 +0200 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-08-07 19:39:26 +0200 |
| commit | e3e15e77f14cc4026fd456cc8a2b5190b2d79610 (patch) | |
| tree | f0687243e608c9dd7eef6e7e3c5c882ccfe505a9 /crypto/asn1 | |
| parent | test: update SSL API test in light of PKCS#1 version 1.5 padding change under... (diff) | |
| download | openssl-e3e15e77f14cc4026fd456cc8a2b5190b2d79610.tar.xz openssl-e3e15e77f14cc4026fd456cc8a2b5190b2d79610.zip | |
do_print_ex(): Avoid possible integer overflow
Fixes Coverity 1604657
Fixes openssl/project#780
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/25084)
Diffstat (limited to 'crypto/asn1')
| -rw-r--r-- | crypto/asn1/a_strex.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c index 89fda41183..87365af32d 100644 --- a/crypto/asn1/a_strex.c +++ b/crypto/asn1/a_strex.c @@ -10,6 +10,7 @@ #include <stdio.h> #include <string.h> #include "internal/cryptlib.h" +#include "internal/sizes.h" #include "crypto/asn1.h" #include <openssl/crypto.h> #include <openssl/x509.h> @@ -342,8 +343,10 @@ static int do_print_ex(char_io *io_ch, void *arg, unsigned long lflags, if (lflags & ASN1_STRFLGS_SHOW_TYPE) { const char *tagname; + tagname = ASN1_tag2str(type); - outlen += strlen(tagname); + /* We can directly cast here as tagname will never be too large. */ + outlen += (int)strlen(tagname); if (!io_ch(arg, tagname, outlen) || !io_ch(arg, ":", 1)) return -1; outlen++; @@ -369,7 +372,7 @@ static int do_print_ex(char_io *io_ch, void *arg, unsigned long lflags, if (type == -1) { len = do_dump(lflags, io_ch, arg, str); - if (len < 0) + if (len < 0 || len > INT_MAX - outlen) return -1; outlen += len; return outlen; @@ -388,7 +391,7 @@ static int do_print_ex(char_io *io_ch, void *arg, unsigned long lflags, } len = do_buf(str->data, str->length, type, flags, "es, io_ch, NULL); - if (len < 0) + if (len < 0 || len > INT_MAX - 2 - outlen) return -1; outlen += len; if (quotes) |