diff options
| author | Drokov Pavel <drokov@rutoken.ru> | 2024-01-12 02:10:17 -0500 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-01-15 10:49:54 +0100 |
| commit | 9aee66b2f4ecc721950b647da4ebf773133dd7c9 (patch) | |
| tree | 3859ed8bb8a10e5601d20b0acea99aaecff39242 | |
| parent | f076c133a175881fecb636385a2f3e6f77b37c43 (diff) | |
Fix arithmetic expression overflow
If the value of a->length is large (>= 2^12), then an integer overflow will
occur for the signed type, which according to the C standard is UB.
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23274)
(cherry picked from commit 486ab0fb003d05f89620662260486d31bd3faa8c)
| -rw-r--r-- | crypto/objects/obj_dat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c index ebde562477..30a63bbbd9 100644 --- a/crypto/objects/obj_dat.c +++ b/crypto/objects/obj_dat.c @@ -128,7 +128,7 @@ static unsigned long added_obj_hash(const ADDED_OBJ *ca) a = ca->obj; switch (ca->type) { case ADDED_DATA: - ret = a->length << 20L; + ret = (unsigned long)a->length << 20UL; p = (unsigned char *)a->data; for (i = 0; i < a->length; i++) ret ^= p[i] << ((i * 3) % 24); |