From a812f8fc8f3c9ba30e5ecd2c168cca0613f15dcd Mon Sep 17 00:00:00 2001 From: bonniegong <46280630+bonniegong@users.noreply.github.com> Date: Mon, 12 Apr 2021 10:43:13 +0800 Subject: check i2d_ASN1_TYPE return value add a length check to the return value of function i2d_ASN1_TYPE. Return an error instead of trying to malloc a negative number. CLA: trivial Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/14828) (cherry picked from commit c65abf2213117eb5348a46fbc18f706aca052e85) --- crypto/asn1/a_strex.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'crypto/asn1') diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c index 4879b33785..7cd18b4b85 100644 --- a/crypto/asn1/a_strex.c +++ b/crypto/asn1/a_strex.c @@ -280,6 +280,8 @@ static int do_dump(unsigned long lflags, char_io *io_ch, void *arg, t.type = str->type; t.value.ptr = (char *)str; der_len = i2d_ASN1_TYPE(&t, NULL); + if (der_len <= 0) + return -1; if ((der_buf = OPENSSL_malloc(der_len)) == NULL) { ASN1err(ASN1_F_DO_DUMP, ERR_R_MALLOC_FAILURE); return -1; -- cgit v1.2.3