coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix IPv6 SAN overflow in cert_write and cert_req

Browse Source 
mbedtls_x509_crt_parse_cn_inet_pton() requires a 16-byte buffer and
writes 16 bytes for an IPv6 address, but both programs passed a 4-byte
one. Use a 16-byte buffer and record the length the function returns
instead of sizeof(ip), so IPv6 addresses are encoded as 16 bytes.

Signed-off-by: Jeremy Levartovsky <140487034+JayOfTheKeyboard@users.noreply.github.com>
This commit is contained in:
Jeremy Levartovsky 2026-10-12 21:34:38 +11:00
parent 14501f4503
commit 954307bb75
No known key found for this signature in database
3 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog.d/x509-programs-ip-san.txt Normal file
View File

@ -0,0 +1,4 @@
Bugfix
* Fix a stack buffer overflow in the cert_write and cert_req sample
programs when an IPv6 address is given in the san parameter. IPv6
addresses are now written correctly.

6
programs/x509/cert_req.c
View File

@ -66,7 +66,7 @@ int main(void)
" DNS:value\n" \
" URI:value\n" \
" RFC822:value\n" \
" IP:value (Only IPv4 is supported)\n" \
" IP:value (IPv4 or IPv6)\n" \
" DN:list of comma separated key=value pairs\n" \
" key_usage=%%s default: (empty)\n" \
" Comma-separated-list of values:\n" \
@ -153,7 +153,7 @@ int main(int argc, char *argv[])
mbedtls_x509write_csr req;
mbedtls_x509_san_list *cur, *prev;
#if defined(MBEDTLS_X509_CRT_PARSE_C)
uint8_t ip[4] = { 0 };
uint8_t ip[16] = { 0 };
#endif
/*
* Set to sane values
@ -268,7 +268,7 @@ usage:
goto exit;
}
cur->node.san.unstructured_name.p = (unsigned char *) ip;
cur->node.san.unstructured_name.len = sizeof(ip);
cur->node.san.unstructured_name.len = ip_addr_len;
} else if (strcmp(q, "DN") == 0) {
cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
/* Work around an API mismatch between string_to_names() and

6
programs/x509/cert_write.c
View File

@ -135,7 +135,7 @@ int main(void)
" DNS:value\n" \
" URI:value\n" \
" RFC822:value\n" \
" IP:value (Only IPv4 is supported)\n" \
" IP:value (IPv4 or IPv6)\n" \
" DN:list of comma separated key=value pairs\n" \
" authority_identifier=%%s default: 1\n" \
" Possible values: 0, 1\n" \
@ -316,7 +316,7 @@ int main(int argc, char *argv[])
size_t serial_len;
mbedtls_asn1_sequence *ext_key_usage;
mbedtls_x509_san_list *cur, *prev;
uint8_t ip[4] = { 0 };
uint8_t ip[16] = { 0 };
/*
* Set to sane values
*/
@ -650,7 +650,7 @@ usage:
goto exit;
}
cur->node.san.unstructured_name.p = (unsigned char *) ip;
cur->node.san.unstructured_name.len = sizeof(ip);
cur->node.san.unstructured_name.len = ip_addr_len;
} else if (strcmp(q, "DN") == 0) {
cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
/* Work around an API mismatch between string_to_names() and