diff options
| author | Rich Salz <rsalz@openssl.org> | 2017-02-21 13:07:13 -0500 |
|---|---|---|
| committer | Rich Salz <rsalz@openssl.org> | 2017-02-21 13:15:27 -0500 |
| commit | 1acdbb3eef4c992c9cebec3cbdf8104761aa7d63 (patch) | |
| tree | 8a17dc573e4b7f354ef7580bf24297d9e65a004d /crypto | |
| parent | d0f38a1b8dbced5366177d41490c6fabe0014e56 (diff) | |
Prevent OOB in SRP base64 code.
Change size comparison from > (GT) to >= (GTE) to ensure an additional
byte of output buffer, to prevent OOB reads/writes later in the function
Reject input strings larger than 2GB
Detect invalid output buffer size and return early
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2672)
(cherry picked from commit ecca16632a73bb80ee27cdec8a97f6def0a4714d)
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/srp/srp_vfy.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c index a8ec52a4da..c8bc7a94b2 100644 --- a/crypto/srp/srp_vfy.c +++ b/crypto/srp/srp_vfy.c @@ -86,10 +86,13 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src) int i, j; int size; + if (alen == 0 || alen > INT_MAX) + return -1; + while (*src && (*src == ' ' || *src == '\t' || *src == '\n')) ++src; size = strlen(src); - if (alen > INT_MAX || size > (int)alen) + if (size < 0 || size >= (int)alen) return -1; i = 0; @@ -127,7 +130,7 @@ static int t_fromb64(unsigned char *a, size_t alen, const char *src) if (--i < 0) break; } - while (a[j] == 0 && j <= size) + while (j <= size && a[j] == 0) ++j; i = 0; while (j <= size) |