coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge e125fbde0217f369007e92aa3f773d2069c5591a into 03e1438089654fb884ac48e0f3cd0049cfe2c102

Browse Source
This commit is contained in:
Ray Chern 2026-10-27 10:46:01 -04:00 committed by GitHub
commit f67218f162
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog.d/fix-x509-crl-entry-length-mismatch.txt Normal file
View File

@ -0,0 +1,9 @@
Bugfix
* Fix x509_get_entries() (used by mbedtls_x509_crl_parse()) not
checking that a revoked-certificate entry's serial number,
revocation date and optional crlEntryExtensions fully consume
the entry's own declared SEQUENCE length. A CRL entry with a
declared length longer than the sum of its actual fields could
have the extra trailing bytes silently reinterpreted as one or
more additional, attacker-influenced CRL entries, instead of
being rejected as malformed.

5
library/x509_crl.c
View File

@ -262,6 +262,11 @@ static int x509_get_entries(unsigned char **p,
return ret;
}
if (*p != end2) {
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
}
if (*p < end) {
cur_entry->next = mbedtls_calloc(1, sizeof(mbedtls_x509_crl_entry));