File CVE-2021-3712-other-ASN1_STRING-issues.patch of Package compat-openssl098

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2021-3712-other-ASN1_STRING-issues.patch of Package compat-openssl098 (Revision 47d995763155c8d5b237e0b3a911e115)

Currently displaying revision 47d995763155c8d5b237e0b3a911e115 , Show latest

diff --git a/crypto/asn1/t_spki.c b/crypto/asn1/t_spki.c
index a73369b..57c47e4 100644
--- a/crypto/asn1/t_spki.c
+++ b/crypto/asn1/t_spki.c
@@ -114,7 +114,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
 	}
 	chal = spki->spkac->challenge;
 	if(chal->length)
-		BIO_printf(out, "  Challenge String: %s\n", chal->data);
+	  BIO_printf(out, "  Challenge String: %.*s\n", chal->length, chal->data);
 	i=OBJ_obj2nid(spki->sig_algor->algorithm);
 	BIO_printf(out,"  Signature Algorithm: %s",
 				(i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c
index 0ef2cee..a583093 100644
--- a/crypto/ec/ec_asn1.c
+++ b/crypto/ec/ec_asn1.c
@@ -922,7 +922,10 @@ static EC_GROUP *ec_asn1_parameters2group(const ECPARAMETERS *params)
 		ret->seed_len = params->curve->seed->length;
 		}
 
-	if (!params->order || !params->base || !params->base->data)
+	if (params->order == NULL
+            || params->base == NULL
+            || params->base->data == NULL
+            || params->base->length == 0)
 		{
 		ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
 		goto err;
diff --git a/crypto/x509v3/v3_akey.c b/crypto/x509v3/v3_akey.c
index c6b68ee..3666954 100644
--- a/crypto/x509v3/v3_akey.c
+++ b/crypto/x509v3/v3_akey.c
@@ -83,21 +83,49 @@ const X509V3_EXT_METHOD v3_akey_id =
 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
 	     AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist)
 {
-	char *tmp;
+    char *tmp = NULL;
+    STACK_OF(CONF_VALUE) *origextlist = extlist, *tmpextlist;
+
 	if(akeyid->keyid) {
 		tmp = hex_to_string(akeyid->keyid->data, akeyid->keyid->length);
-		X509V3_add_value("keyid", tmp, &extlist);
+        if (tmp == NULL) {
+            X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_MALLOC_FAILURE);
+            return NULL;
+        }
+        if (!X509V3_add_value("keyid", tmp, &extlist)) {
+            OPENSSL_free(tmp);
+            X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_X509_LIB);
+            goto err;
+        }
 		OPENSSL_free(tmp);
 	}
-	if(akeyid->issuer) 
-		extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist);
+    if (akeyid->issuer) {
+        tmpextlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist);
+        if (tmpextlist == NULL) {
+            X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_X509_LIB);
+            goto err;
+        }
+        extlist = tmpextlist;
+    }
 	if(akeyid->serial) {
 		tmp = hex_to_string(akeyid->serial->data,
 						 akeyid->serial->length);
-		X509V3_add_value("serial", tmp, &extlist);
+        if (tmp == NULL) {
+            X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_MALLOC_FAILURE);
+            goto err;
+        }
+        if (!X509V3_add_value("serial", tmp, &extlist)) {
+            OPENSSL_free(tmp);
+            X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_X509_LIB);
+            goto err;
+        }
 		OPENSSL_free(tmp);
 	}
 	return extlist;
+ err:
+    if (origextlist == NULL)
+        sk_CONF_VALUE_pop_free(extlist, X509V3_conf_free);
+    return NULL;
 }
 
 /* Currently two options:
diff --git a/crypto/x509v3/v3_alt.c b/crypto/x509v3/v3_alt.c
index 58b2952..52cb573 100644
--- a/crypto/x509v3/v3_alt.c
+++ b/crypto/x509v3/v3_alt.c
@@ -58,6 +58,7 @@
 
 #include <stdio.h>
 #include "cryptlib.h"
+#include <openssl/x509.h>
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
@@ -118,15 +119,18 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
 		break;
 
 		case GEN_EMAIL:
-		X509V3_add_value_uchar("email",gen->d.ia5->data, &ret);
+		  x509v3_add_len_value_uchar("email", gen->d.ia5->data,
+					     gen->d.ia5->length, &ret);
 		break;
 
 		case GEN_DNS:
-		X509V3_add_value_uchar("DNS",gen->d.ia5->data, &ret);
+		  x509v3_add_len_value_uchar("DNS", gen->d.ia5->data,
+					     gen->d.ia5->length, &ret);
 		break;
 
 		case GEN_URI:
-		X509V3_add_value_uchar("URI",gen->d.ia5->data, &ret);
+		  x509v3_add_len_value_uchar("URI", gen->d.ia5->data,
+					     gen->d.ia5->length, &ret);
 		break;
 
 		case GEN_DIRNAME:
diff --git a/crypto/x509v3/v3_cpols.c b/crypto/x509v3/v3_cpols.c
index a58e4f1..bfe8d4d 100644
--- a/crypto/x509v3/v3_cpols.c
+++ b/crypto/x509v3/v3_cpols.c
@@ -385,8 +385,9 @@ static void print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals,
 		switch(OBJ_obj2nid(qualinfo->pqualid))
 		{
 			case NID_id_qt_cps:
-			BIO_printf(out, "%*sCPS: %s\n", indent, "",
-						qualinfo->d.cpsuri->data);
+			  BIO_printf(out, "%*sCPS: %.*s\n", indent, "",
+				     qualinfo->d.cpsuri->length,
+				     qualinfo->d.cpsuri->data);
 			break;
 		
 			case NID_id_qt_unotice:
@@ -411,8 +412,9 @@ static void print_notice(BIO *out, USERNOTICE *notice, int indent)
 	if(notice->noticeref) {
 		NOTICEREF *ref;
 		ref = notice->noticeref;
-		BIO_printf(out, "%*sOrganization: %s\n", indent, "",
-						 ref->organization->data);
+		BIO_printf(out, "%*sOrganization: %.*s\n", indent, "",
+			   ref->organization->length,
+			   ref->organization->data);
 		BIO_printf(out, "%*sNumber%s: ", indent, "",
 			   sk_ASN1_INTEGER_num(ref->noticenos) > 1 ? "s" : "");
 		for(i = 0; i < sk_ASN1_INTEGER_num(ref->noticenos); i++) {
@@ -429,8 +431,9 @@ static void print_notice(BIO *out, USERNOTICE *notice, int indent)
 		BIO_puts(out, "\n");
 	}
 	if(notice->exptext)
-		BIO_printf(out, "%*sExplicit Text: %s\n", indent, "",
-							 notice->exptext->data);
+	  BIO_printf(out, "%*sExplicit Text: %.*s\n", indent, "",
+		     notice->exptext->length,
+		     notice->exptext->data);
 }
 
 void X509_POLICY_NODE_print(BIO *out, X509_POLICY_NODE *node, int indent)
diff --git a/crypto/x509v3/v3_pci.c b/crypto/x509v3/v3_pci.c
index 601211f..1c16534 100644
--- a/crypto/x509v3/v3_pci.c
+++ b/crypto/x509v3/v3_pci.c
@@ -67,8 +67,9 @@ static int i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci,
 	i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
 	BIO_puts(out, "\n");
 	if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
-	  BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
-		     pci->proxyPolicy->policy->data);
+        BIO_printf(out, "%*sPolicy Text: %.*s\n", indent, "",
+                   pci->proxyPolicy->policy->length,
+		   pci->proxyPolicy->policy->data);
 	return 1;
 	}
 
diff --git a/crypto/x509v3/v3_utl.c b/crypto/x509v3/v3_utl.c
index a4236bb..f1ed508 100644
--- a/crypto/x509v3/v3_utl.c
+++ b/crypto/x509v3/v3_utl.c
@@ -63,6 +63,7 @@
 #include "cryptlib.h"
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
+#include <string.h>
 #include <openssl/bn.h>
 
 static char *strip_spaces(char *name);
@@ -78,13 +79,24 @@ static int ipv6_hex(unsigned char *out, const char *in, int inlen);
 
 /* Add a CONF_VALUE name value pair to stack */
 
-int X509V3_add_value(const char *name, const char *value,
-						STACK_OF(CONF_VALUE) **extlist)
+static int x509v3_add_len_value(const char *name, const char *value,
+                                size_t vallen, STACK_OF(CONF_VALUE) **extlist)
 {
 	CONF_VALUE *vtmp = NULL;
 	char *tname = NULL, *tvalue = NULL;
-	if(name && !(tname = BUF_strdup(name))) goto err;
-	if(value && !(tvalue = BUF_strdup(value))) goto err;;
+	if (name != NULL && (tname = BUF_strdup(name)) == NULL)
+	  goto err;
+	if (value != NULL && vallen > 0) {
+	  /*
+	   * We tolerate a single trailing NUL character, but otherwise no
+	   * embedded NULs
+	   */
+	  if (memchr(value, 0, vallen - 1) != NULL)
+            goto err;
+	  tvalue = BUF_strndup(value, vallen);
+	  if (tvalue == NULL)
+            goto err;
+	}
 	if(!(vtmp = (CONF_VALUE *)OPENSSL_malloc(sizeof(CONF_VALUE)))) goto err;
 	if(!*extlist && !(*extlist = sk_CONF_VALUE_new_null())) goto err;
 	vtmp->section = NULL;
@@ -100,10 +112,26 @@ int X509V3_add_value(const char *name, const char *value,
 	return 0;
 }
 
+int X509V3_add_value(const char *name, const char *value,
+                     STACK_OF(CONF_VALUE) **extlist)
+{
+    return x509v3_add_len_value(name, value,
+                                value != NULL ? strlen((const char *)value) : 0,
+                                extlist);
+}
+
 int X509V3_add_value_uchar(const char *name, const unsigned char *value,
 			   STACK_OF(CONF_VALUE) **extlist)
     {
-    return X509V3_add_value(name,(const char *)value,extlist);
+    return x509v3_add_len_value(name, (const char *)value,
+                                value != NULL ? strlen((const char *)value) : 0,
+                                extlist);
+}
+
+int x509v3_add_len_value_uchar(const char *name, const unsigned char *value,
+                               size_t vallen, STACK_OF(CONF_VALUE) **extlist)
+{
+    return x509v3_add_len_value(name, (const char *)value, vallen, extlist);
     }
 
 /* Free function for STACK_OF(CONF_VALUE) */
@@ -546,13 +574,23 @@ static int append_ia5(STACK **sk, ASN1_IA5STRING *email)
 	char *emtmp;
 	/* First some sanity checks */
 	if(email->type != V_ASN1_IA5STRING) return 1;
-	if(!email->data || !email->length) return 1;
+	if (email->data == NULL || email->length == 0)
+	  return 1;
+	if (memchr(email->data, 0, email->length) != NULL)
+	  return 1;
 	if(!*sk) *sk = sk_new(sk_strcmp);
 	if(!*sk) return 0;
+
+    emtmp = BUF_strndup((char *)email->data, email->length);
+    if (emtmp == NULL)
+        return 0;
+
 	/* Don't add duplicates */
-	if(sk_find(*sk, (char *)email->data) != -1) return 1;
-	emtmp = BUF_strdup((char *)email->data);
-	if(!emtmp || !sk_push(*sk, emtmp)) {
+    if (sk_find(*sk, emtmp) != -1) {
+      OPENSSL_free(emtmp);
+	  return 1;
+    }
+    if (!sk_push(*sk, emtmp)) {
 		X509_email_free(*sk);
 		*sk = NULL;
 		return 0;
diff --git a/crypto/x509v3/x509v3.h b/crypto/x509v3/x509v3.h
index 9ef83da..2b60214 100644
--- a/crypto/x509v3/x509v3.h
+++ b/crypto/x509v3/x509v3.h
@@ -627,6 +627,9 @@ int a2i_ipadd(unsigned char *ipout, const char *ipasc);
 int X509V3_NAME_from_section(X509_NAME *nm, STACK_OF(CONF_VALUE)*dn_sk,
 						unsigned long chtype);
 
+int x509v3_add_len_value_uchar(const char *name, const unsigned char *value,
+                               size_t vallen, STACK_OF(CONF_VALUE) **extlist);
+
 void X509_POLICY_NODE_print(BIO *out, X509_POLICY_NODE *node, int indent);
 
 #ifndef OPENSSL_NO_RFC3779

Places

File CVE-2021-3712-other-ASN1_STRING-issues.patch of Package compat-openssl098 (Revision 47d995763155c8d5b237e0b3a911e115)

Places