coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Reject overflowing numeric OID components

Browse Source 
Backport of f79eac885dec294d6e441bada15be1605dcb75b0. Adapt the check and tests to the 3.6 OID parser.

Refs Mbed-TLS/mbedtls#10911.

Signed-off-by: subotac <73706465+subotac@users.noreply.github.com>
This commit is contained in:
subotac 2026-10-06 23:18:23 +03:00
parent 27e5c190dc
commit 83a9004401
3 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog.d/numeric-oid-overflow.txt Normal file
View File

@ -0,0 +1,3 @@
Bugfix
* Reject numeric OID components that exceed the range of unsigned int
instead of silently encoding a different value. Fixes #10910.

2
library/oid.c
View File

@ -995,7 +995,7 @@ static int oid_parse_number(unsigned int *num, const char **p, const char *bound
while (*p < bound && **p >= '0' && **p <= '9') {
ret = 0;
if (*num > (UINT_MAX / 10)) {
if (*num > (UINT_MAX - (unsigned int) (**p - '0')) / 10) {
return MBEDTLS_ERR_ASN1_INVALID_DATA;
}
*num *= 10;

9
tests/suites/test_suite_oid.data
View File

@ -202,6 +202,15 @@ oid_from_numeric_string:"2.4294967215":0:"8FFFFFFF7F"
OID from numeric string - OID with overflowing subidentifier
oid_from_numeric_string:"2.4294967216":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component overflows on final digit
oid_from_numeric_string:"2.4294967296":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component overflows to nonzero value
oid_from_numeric_string:"2.4294967299":MBEDTLS_ERR_ASN1_INVALID_DATA:""
OID from numeric string - numeric component continues after overflow
oid_from_numeric_string:"2.42949672966":MBEDTLS_ERR_ASN1_INVALID_DATA:""
mbedtls_oid_get_md_hmac - RIPEMD160
depends_on:MBEDTLS_MD_CAN_RIPEMD160
mbedtls_oid_get_md_hmac:"2B06010505080104":MBEDTLS_MD_RIPEMD160