From ea96ad5a206b7b5f25dad230333e8ff032df3219 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 28 Apr 2016 10:46:55 +0100 Subject: Prevent EBCDIC overread for very long strings ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer. Issue reported by Guido Vranken. CVE-2016-2176 Reviewed-by: Andy Polyakov --- crypto/x509/x509_obj.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'crypto/x509') diff --git a/crypto/x509/x509_obj.c b/crypto/x509/x509_obj.c index f6c348fb0d..eaa03f2b88 100644 --- a/crypto/x509/x509_obj.c +++ b/crypto/x509/x509_obj.c @@ -130,8 +130,9 @@ char *X509_NAME_oneline(X509_NAME *a, char *buf, int len) type == V_ASN1_PRINTABLESTRING || type == V_ASN1_TELETEXSTRING || type == V_ASN1_VISIBLESTRING || type == V_ASN1_IA5STRING) { - ascii2ebcdic(ebcdic_buf, q, (num > (int)sizeof(ebcdic_buf)) - ? (int)sizeof(ebcdic_buf) : num); + if (num > (int)sizeof(ebcdic_buf)) + num = sizeof(ebcdic_buf); + ascii2ebcdic(ebcdic_buf, q, num); q = ebcdic_buf; } #endif -- cgit v1.2.3