diff options
author | David Benjamin <davidben@google.com> | 2017-09-18 15:58:41 -0400 |
---|---|---|
committer | Andy Polyakov <appro@openssl.org> | 2017-09-19 21:31:30 +0200 |
commit | 6b1c8204b33aaedb7df7a009c241412839aaf950 (patch) | |
tree | 9b822badeb0715731bd89aea53efb6302a2a8798 /ssl/t1_lib.c | |
parent | d2ef6e4ecc517de9d3d7f71180a6855f1f4d3243 (diff) |
Fix overflow in c2i_ASN1_BIT_STRING.
c2i_ASN1_BIT_STRING takes length as a long but uses it as an int. Check
bounds before doing so. Previously, excessively large inputs to the
function could write a single byte outside the target buffer. (This is
unreachable as asn1_ex_c2i already uses int for the length.)
Thanks to NCC for finding this issue. Fix written by Martin Kreichgauer.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4385)
Diffstat (limited to 'ssl/t1_lib.c')
0 files changed, 0 insertions, 0 deletions