coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Reject overflowing numeric OID components

Browse Source 
Backport of f79eac885dec294d6e441bada15be1605dcb75b0.

Refs Mbed-TLS/mbedtls#10911.

Signed-off-by: subotac <73706465+subotac@users.noreply.github.com>
This commit is contained in:
subotac 2026-10-06 23:18:15 +03:00
parent 14501f4503
commit 7b0eb04af9
3 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog.d/numeric-oid-overflow.txt Normal file
View File

@ -0,0 +1,3 @@
Bugfix
* Reject numeric OID components that exceed the range of unsigned int
instead of silently encoding a different value. Fixes #10910.

2
library/x509_create.c
View File

@ -287,7 +287,7 @@ static int oid_parse_number(unsigned int *num, const char **p, const char *bound
while (*p < bound && **p >= '0' && **p <= '9') {
ret = 0;
if (*num > (UINT_MAX / 10)) {
if (*num > (UINT_MAX - (unsigned int) (**p - '0')) / 10) {
return MBEDTLS_ERR_ASN1_INVALID_DATA;
}
*num *= 10;

9
tests/suites/test_suite_x509write.data
View File

@ -337,3 +337,12 @@ oid_from_numeric_string:"2.4294967215":0:"8FFFFFFF7F"
OID from numeric string - OID with overflowing subidentifier
oid_from_numeric_string:"2.4294967216":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component overflows on final digit
oid_from_numeric_string:"2.4294967296":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component overflows to nonzero value
oid_from_numeric_string:"2.4294967299":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component continues after overflow
oid_from_numeric_string:"2.42949672966":MBEDTLS_ERR_ASN1_INVALID_DATA:""