F-4935 - Guard word32 length overflow in wp_read_pem_bio - #452
Open
ColtonWilley wants to merge 1 commit into
Open
F-4935 - Guard word32 length overflow in wp_read_pem_bio#452ColtonWilley wants to merge 1 commit into
ColtonWilley wants to merge 1 commit into
Conversation
Port the UINT32_MAX bound already present in wp_read_der_bio. Honor a failed read in wp_pem2der_decode instead of decoding a partial buffer. Use WP_FITS_WORD32 in both guards and fix %d used for long readLen.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fenrir F-4935. Ports the word32 bound already in
wp_read_der_bio(#438).Reported OOB write does not occur — on LP64 the realloc size computes in
long, andCRYPTO_realloc(p, 0)returns NULL. Impact is truncation after 4GB.wp_pem2der_decodesetok = 0on read failure then overwrote it with the decode result. Now gated onok.Also fixes
%dused forlong readLen.No test — the guard needs a 4GB PEM.