mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2024-12-29 09:21:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent signed integer overflow in CSR parsing

Browse Source 
Modify the function mbedtls_x509_csr_parse_der() so that it checks the
parsed CSR version integer before it increments the value. This prevents
a potential signed integer overflow, as these have undefined behaviour
in the C standard.
This commit is contained in:
Andres AG 2017-02-17 13:54:43 +00:00 committed by Simon Butcher
parent 80164741e1
commit 2e3ddfac5f
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -46,6 +46,10 @@ Bugfix
Reported and fix suggested by guidovranken in #740 Reported and fix suggested by guidovranken in #740
* Fix conditional preprocessor directives in bignum.h to enable 64-bit * Fix conditional preprocessor directives in bignum.h to enable 64-bit
compilation when using ARM Compiler 6. compilation when using ARM Compiler 6.
* Fix potential integer overflow in the version verification for DER
encoded X509 CSRs. The overflow would enable maliciously constructed CSRs
to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
KNOX Security, Samsung Research America
Security Security
* Fix authentication bypass in SSL/TLS: when auth_mode is set to optional, * Fix authentication bypass in SSL/TLS: when auth_mode is set to optional,

6
library/x509_csr.c
View File

@ -168,14 +168,14 @@ int mbedtls_x509_csr_parse_der( mbedtls_x509_csr *csr,
return( ret ); return( ret );
} }
csr->version++; if( csr->version != 0 )
if( csr->version != 1 )
{ {
mbedtls_x509_csr_free( csr ); mbedtls_x509_csr_free( csr );
return( MBEDTLS_ERR_X509_UNKNOWN_VERSION ); return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
} }
csr->version++;
/* /*
* subject Name * subject Name
*/ */