diff options
| author | Pauli <paul.dale@oracle.com> | 2017-07-06 11:39:03 +1000 |
|---|---|---|
| committer | Pauli <paul.dale@oracle.com> | 2017-07-06 12:59:51 +1000 |
| commit | 60eba30f60de55e3c782469fa555eede82606099 (patch) | |
| tree | 682efcc6cc77d5759c2ffa2d61897ccb28ee5018 /crypto/asn1/x_long.c | |
| parent | eee9552212ecc9e19bc09ea8a1b8428dc7394f45 (diff) | |
Memory bounds checking in asn1 code.
Check that sprint, strcpy don't overflow.
Avoid some strlen operations when the previous sprintf return value can be used.
Also fix the undefined behaviour `*(long *)x = y` when x isn't a long or character pointer.
ISO/IEC 9899:1999 6.5/7 for the details.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3869)
Diffstat (limited to 'crypto/asn1/x_long.c')
| -rw-r--r-- | crypto/asn1/x_long.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/crypto/asn1/x_long.c b/crypto/asn1/x_long.c index 78f4b764c3..bf9371ef55 100644 --- a/crypto/asn1/x_long.c +++ b/crypto/asn1/x_long.c @@ -1,5 +1,5 @@ /* - * Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -14,6 +14,9 @@ #if !(OPENSSL_API_COMPAT < 0x10200000L) NON_EMPTY_TRANSLATION_UNIT #else + +#define COPY_SIZE(a, b) (sizeof(a) < sizeof(b) ? sizeof(a) : sizeof(b)) + /* * Custom primitive type for long handling. This converts between an * ASN1_INTEGER and a long directly. @@ -49,13 +52,13 @@ ASN1_ITEM_end(ZLONG) static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it) { - *(long *)pval = it->size; + memcpy(pval, &it->size, COPY_SIZE(*pval, it->size)); return 1; } static void long_free(ASN1_VALUE **pval, const ASN1_ITEM *it) { - *(long *)pval = it->size; + memcpy(pval, &it->size, COPY_SIZE(*pval, it->size)); } /* @@ -90,7 +93,7 @@ static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, unsigned long utmp, sign; int clen, pad, i; - ltmp = *(long *)pval; + memcpy(<mp, pval, COPY_SIZE(*pval, ltmp)); if (ltmp == it->size) return -1; /* @@ -183,13 +186,16 @@ static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG); return 0; } - *(long*)pval = ltmp; + memcpy(pval, <mp, COPY_SIZE(*pval, ltmp)); return 1; } static int long_print(BIO *out, ASN1_VALUE **pval, const ASN1_ITEM *it, int indent, const ASN1_PCTX *pctx) { - return BIO_printf(out, "%ld\n", *(long *)pval); + long l; + + memcpy(&l, pval, COPY_SIZE(*pval, l)); + return BIO_printf(out, "%ld\n", l); } #endif |