From 7c038a6bcd98d4bbfd2c2892a87a1138d2f7c5f3 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 19 Aug 2021 12:23:38 +0100 Subject: Fix NETSCAPE_SPKI_print function to not assume NUL terminated strings ASN.1 strings may not be NUL terminated. Don't assume they are. CVE-2021-3712 Reviewed-by: Viktor Dukhovni Reviewed-by: Paul Dale Reviewed-by: David Benjamin --- crypto/asn1/t_spki.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'crypto/asn1/t_spki.c') diff --git a/crypto/asn1/t_spki.c b/crypto/asn1/t_spki.c index b634808c43..3d85e08686 100644 --- a/crypto/asn1/t_spki.c +++ b/crypto/asn1/t_spki.c @@ -38,7 +38,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki) } chal = spki->spkac->challenge; if (chal->length) - BIO_printf(out, " Challenge String: %s\n", chal->data); + BIO_printf(out, " Challenge String: %.*s\n", chal->length, chal->data); i = OBJ_obj2nid(spki->sig_algor.algorithm); BIO_printf(out, " Signature Algorithm: %s", (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); -- cgit v1.2.3