diff options
| author | Matt Caswell <matt@openssl.org> | 2021-08-19 15:25:04 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2021-08-24 14:22:07 +0100 |
| commit | e20fc2ee4fc90ac1476b3a9b15b37542bfb1af73 (patch) | |
| tree | cbfb33fe9e1cf77630baf8fac30ea504e0895d42 /crypto/asn1 | |
| parent | 030c5aba94788f152f9ceef3549815df45bef702 (diff) | |
Allow fuzz builds to detect string overruns
If FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is defined then we don't NUL
terminate ASN1_STRING datatypes. This shouldn't be necessary but we add it
any for safety in normal builds.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David Benjamin <davidben@google.com>
Diffstat (limited to 'crypto/asn1')
| -rw-r--r-- | crypto/asn1/asn1_lib.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/crypto/asn1/asn1_lib.c b/crypto/asn1/asn1_lib.c index bdd0ec488d..02c34a4438 100644 --- a/crypto/asn1/asn1_lib.c +++ b/crypto/asn1/asn1_lib.c @@ -301,7 +301,12 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in) } if ((size_t)str->length <= len || str->data == NULL) { c = str->data; +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + /* No NUL terminator in fuzzing builds */ + str->data = OPENSSL_realloc(c, len); +#else str->data = OPENSSL_realloc(c, len + 1); +#endif if (str->data == NULL) { ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE); str->data = c; @@ -311,8 +316,13 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in) str->length = len; if (data != NULL) { memcpy(str->data, data, len); - /* an allowance for strings :-) */ +#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + /* + * Add a NUL terminator. This should not be necessary - but we add it as + * a safety precaution + */ str->data[len] = '\0'; +#endif } return 1; } |