From 83a90044010c46456f7f90bbeb2ab954d1ac75b6 Mon Sep 17 00:00:00 2001 From: subotac <73706465+subotac@users.noreply.github.com> Date: Tue, 6 Oct 2026 23:18:23 +0300 Subject: [PATCH] Reject overflowing numeric OID components Backport of f79eac885dec294d6e441bada15be1605dcb75b0. Adapt the check and tests to the 3.6 OID parser. Refs Mbed-TLS/mbedtls#10911. Signed-off-by: subotac <73706465+subotac@users.noreply.github.com> --- ChangeLog.d/numeric-oid-overflow.txt | 3 +++ library/oid.c | 2 +- tests/suites/test_suite_oid.data | 9 +++++++++ 3 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 ChangeLog.d/numeric-oid-overflow.txt diff --git a/ChangeLog.d/numeric-oid-overflow.txt b/ChangeLog.d/numeric-oid-overflow.txt new file mode 100644 index 0000000000..996881d56e --- /dev/null +++ b/ChangeLog.d/numeric-oid-overflow.txt @@ -0,0 +1,3 @@ +Bugfix + * Reject numeric OID components that exceed the range of unsigned int + instead of silently encoding a different value. Fixes #10910. diff --git a/library/oid.c b/library/oid.c index 1d6b1eb866..a58433c101 100644 --- a/library/oid.c +++ b/library/oid.c @@ -995,7 +995,7 @@ static int oid_parse_number(unsigned int *num, const char **p, const char *bound while (*p < bound && **p >= '0' && **p <= '9') { ret = 0; - if (*num > (UINT_MAX / 10)) { + if (*num > (UINT_MAX - (unsigned int) (**p - '0')) / 10) { return MBEDTLS_ERR_ASN1_INVALID_DATA; } *num *= 10; diff --git a/tests/suites/test_suite_oid.data b/tests/suites/test_suite_oid.data index f8f1d43aa1..ff7452aa93 100644 --- a/tests/suites/test_suite_oid.data +++ b/tests/suites/test_suite_oid.data @@ -202,6 +202,15 @@ oid_from_numeric_string:"2.4294967215":0:"8FFFFFFF7F" OID from numeric string - OID with overflowing subidentifier oid_from_numeric_string:"2.4294967216":MBEDTLS_ERR_ASN1_INVALID_DATA:"" +OID from numeric string - numeric component overflows on final digit +oid_from_numeric_string:"2.4294967296":MBEDTLS_ERR_ASN1_INVALID_DATA:"" + +OID from numeric string - numeric component overflows to nonzero value +oid_from_numeric_string:"2.4294967299":MBEDTLS_ERR_ASN1_INVALID_DATA:"" + +OID from numeric string - numeric component continues after overflow +oid_from_numeric_string:"2.42949672966":MBEDTLS_ERR_ASN1_INVALID_DATA:"" + mbedtls_oid_get_md_hmac - RIPEMD160 depends_on:MBEDTLS_MD_CAN_RIPEMD160 mbedtls_oid_get_md_hmac:"2B06010505080104":MBEDTLS_MD_RIPEMD160