diff options
| author | bonniegong <yuanjungong96@gmail.com> | 2021-06-02 15:35:18 +0800 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2021-06-03 17:09:52 +0200 |
| commit | 5478387c14e0c22a525e2ec5ed37f6ffad4b7c59 (patch) | |
| tree | 4d349a83bfe3dca23a00c73b5085229f289878f8 /crypto | |
| parent | 869e1424438b3c117d6ef4d3fbf4545cc7dab171 (diff) | |
Check the return value of ASN1_STRING_length
ASN1_STRING_length gets the field 'length' of msg, which
can be manipulated through a crafted input.
Add a check to avoid error execution of OPENSSL_malloc().
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15583)
(cherry picked from commit effb0dcf864110a4595f1a243adb9c1dd09eb516)
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/ts/ts_verify_ctx.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/ts/ts_verify_ctx.c b/crypto/ts/ts_verify_ctx.c index 1e80e0d370..803fbe44a7 100644 --- a/crypto/ts/ts_verify_ctx.c +++ b/crypto/ts/ts_verify_ctx.c @@ -126,6 +126,8 @@ TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) goto err; msg = imprint->hashed_msg; ret->imprint_len = ASN1_STRING_length(msg); + if (ret->imprint_len <= 0) + goto err; if ((ret->imprint = OPENSSL_malloc(ret->imprint_len)) == NULL) goto err; memcpy(ret->imprint, ASN1_STRING_get0_data(msg), ret->imprint_len); |