Attachment 685411 Details for Bug 902958 – Don't crash on bad certs.

[patch] Don't crash on bad certs.

coolkey-1.1.0-mem-over.patch (text/plain), 2.02 KB, created by Bob Relyea on 2013-01-22 19:56:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bob Relyea

Created: 2013-01-22 19:56:11 UTC

Size: 2.02 KB

patch

obsolete

>diff -up ./src/coolkey/object.cpp.mem_over ./src/coolkey/object.cpp
>--- ./src/coolkey/object.cpp.mem_over	2013-01-21 14:01:17.627550000 -0800
>+++ ./src/coolkey/object.cpp	2013-01-21 14:08:57.231633000 -0800
>@@ -505,9 +505,15 @@ dataStart(const CKYByte *buf, unsigned i
>     unsigned char tag;
>     unsigned int used_length= 0;
> 
>+    *data_length = 0; /* make sure data_length is zero on failure */
>+
>     if(!buf) {
>         return NULL;
>     }
>+    /* there must be at least 2 bytes */
>+    if (length < 2) {
>+	return NULL;
>+    }
> 
>     tag = buf[used_length++];
> 
>@@ -521,15 +527,22 @@ dataStart(const CKYByte *buf, unsigned i
>     if (*data_length&0x80) {
>         int  len_count = *data_length & 0x7f;
> 
>+	if (len_count+used_length > length) {
>+	    return NULL;
>+	}
>+
>         *data_length = 0;
> 
>         while (len_count-- > 0) {
>             *data_length = (*data_length << 8) | buf[used_length++];
>         }
>     }
>+    /* paranoia, can't happen */
>+    if (length < used_length) {
>+	return NULL;
>+    }
> 
>     if (*data_length > (length-used_length) ) {
>-        *data_length = length-used_length;
>         return NULL;
>     }
>     if (includeTag) *data_length += used_length;
>@@ -966,6 +979,7 @@ GetCN(const CKYByte *dn, unsigned int dn
> 
> 	/* unwrap the set */
> 	name = dataStart(buf, buf_length, &name_length, false);
>+	if (name == NULL) return SECFailure;
> 
>         /* advance to next set */
> 	buf_length -= (name-buf) + name_length;
>@@ -973,9 +987,11 @@ GetCN(const CKYByte *dn, unsigned int dn
> 
> 	/* unwrap the Sequence */
> 	name = dataStart(name, name_length, &name_length, false);
>+	if (name == NULL) return SECFailure;
> 
>         /* unwrap the oid */
> 	oid = dataStart(name, name_length, &oid_length, false);
>+	if (oid == NULL) return SECFailure;
> 
> 	/* test the oid */
> 	if (oid_length != CN_LENGTH) {
>@@ -991,6 +1007,7 @@ GetCN(const CKYByte *dn, unsigned int dn
> 
> 	/* unwrap the CN */
> 	cn->data = dataStart(name, name_length, &cn->len, false);
>+	if (cn->data == NULL) return SECFailure;
> 	return SECSuccess;
>     }
>     return SECFailure;

Actions: View | Diff

Attachments on bug 902958: 685411