kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Ensure we check i2d_X509 return val

Browse Source 
The i2d_X509() function can return a negative value on error. Therefore
we should make sure we check it.

Issue reported by Yuan Jochen Kang.

(Imported from upstream's 8f43c80bfac15544820739bf035df946eeb603e8)

Change-Id: If247d5bf1d792eb7c6dc179b606ed21ea0ccdbb8
Reviewed-on: https://boringssl-review.googlesource.com/7743
Reviewed-by: David Benjamin <davidben@google.com>
This commit is contained in:
Steven Valdez 2016-04-26 12:57:22 -04:00 committed by David Benjamin
parent 14b07a02a6
commit b32a9151da
2 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
crypto/x509/x_x509.c
View File

@ -206,10 +206,20 @@ X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp, long length)
int i2d_X509_AUX(X509 *a, unsigned char **pp)
{
int length;
int length, tmplen;
unsigned char *start = *pp;
length = i2d_X509(a, pp);
if (a)
length += i2d_X509_CERT_AUX(a->aux, pp);
if (length < 0 || a == NULL) {
return length;
}
tmplen = i2d_X509_CERT_AUX(a->aux, pp);
if (tmplen < 0) {
*pp = start;
return tmplen;
}
length += tmplen;
return length;
}

9
ssl/ssl_cert.c
View File

@ -422,13 +422,18 @@ static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x) {
uint8_t *p;
n = i2d_X509(x, NULL);
if (!BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
return 0;
}
p = (uint8_t *)&(buf->data[*l]);
l2n3(n, p);
i2d_X509(x, &p);
n = i2d_X509(x, &p);
if (n < 0) {
/* This shouldn't happen. */
OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
return 0;
}
*l += n + 3;
return 1;