diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2012-04-19 16:19:07 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2012-04-19 16:19:07 +0000 |
| commit | 564a503b1b80ad5919952809d2f988a81fbddcd2 (patch) | |
| tree | 5a35c0628166a23b799a6e40d429c41faeb7365f /crypto/mem.c | |
| parent | 56eeb1b28ce326da133cedb33299e8329a9538b7 (diff) | |
Check for potentially exploitable overflows in asn1_d2i_read_bio
BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
in CRYPTO_realloc_clean.
Thanks to Tavis Ormandy, Google Security Team, for discovering this
issue and to Adam Langley <agl@chromium.org> for fixing it. (CVE-2012-2110)
Diffstat (limited to 'crypto/mem.c')
| -rw-r--r-- | crypto/mem.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/crypto/mem.c b/crypto/mem.c index 8f736c3b1f..21c0011380 100644 --- a/crypto/mem.c +++ b/crypto/mem.c @@ -363,6 +363,10 @@ void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file, if (num <= 0) return NULL; + /* We don't support shrinking the buffer. Note the memcpy that copies + * |old_len| bytes to the new buffer, below. */ + if (num < old_len) return NULL; + if (realloc_debug_func != NULL) realloc_debug_func(str, NULL, num, file, line, 0); ret=malloc_ex_func(num,file,line); |