coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10997 from subotac/fix/numeric-oid-overflow-4.1

Browse Source 
Backport 4.1: Reject overflowing numeric OID components
This commit is contained in:
Manuel Pégourié-Gonnard 2026-10-13 09:24:32 +00:00 committed by GitHub
commit 7e75131af9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog.d/numeric-oid-overflow.txt Normal file
View File

@ -0,0 +1,3 @@
Bugfix
* Reject numeric OID components that exceed the range of unsigned int
instead of silently encoding a different value. Fixes #10910.

2
library/x509_create.c
View File

@ -287,7 +287,7 @@ static int oid_parse_number(unsigned int *num, const char **p, const char *bound
while (*p < bound && **p >= '0' && **p <= '9') {
ret = 0;
if (*num > (UINT_MAX / 10)) {
if (*num > (UINT_MAX - (unsigned int) (**p - '0')) / 10) {
return MBEDTLS_ERR_ASN1_INVALID_DATA;
}
*num *= 10;

9
tests/suites/test_suite_x509write.data
View File

@ -337,3 +337,12 @@ oid_from_numeric_string:"2.4294967215":0:"8FFFFFFF7F"
OID from numeric string - OID with overflowing subidentifier
oid_from_numeric_string:"2.4294967216":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component overflows on final digit
oid_from_numeric_string:"2.4294967296":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component overflows to nonzero value
oid_from_numeric_string:"2.4294967299":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component continues after overflow
oid_from_numeric_string:"2.42949672966":MBEDTLS_ERR_ASN1_INVALID_DATA:""