mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-11 11:04:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

Don't assume the type we read was the type we expected

Browse Source 
i2v_GENERAL_NAME and GENERAL_NAME_print were assuming that the type of
of a GENERAL_NAME (OTHERNAME) that we read in was the type we expected
it to be. If its something else then this can cause unexpected
behaviour. In the added fuzz test case an OOB read was occurring.

This issue was recently added by commit 4baee2d.

Credit to OSSFuzz for finding this issue.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10300)
This commit is contained in:
Matt Caswell 2019-10-30 13:23:18 +00:00
parent 45b244620a
commit aec9667bd1
2 changed files with 37 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
crypto/x509/v3_alt.c
View File

@ -86,19 +86,31 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
case GEN_OTHERNAME:
switch (OBJ_obj2nid(gen->d.otherName->type_id)) {
case NID_id_on_SmtpUTF8Mailbox:
if (!X509V3_add_value_uchar("othername: SmtpUTF8Mailbox:", gen->d.otherName->value->value.utf8string->data, &ret))
if (gen->d.otherName->value->type != V_ASN1_UTF8STRING
|| !X509V3_add_value_uchar("othername: SmtpUTF8Mailbox:",
gen->d.otherName->value->value.utf8string->data,
&ret))
return NULL;
break;
case NID_XmppAddr:
if (!X509V3_add_value_uchar("othername: XmppAddr:", gen->d.otherName->value->value.utf8string->data, &ret))
if (gen->d.otherName->value->type != V_ASN1_UTF8STRING
|| !X509V3_add_value_uchar("othername: XmppAddr:",
gen->d.otherName->value->value.utf8string->data,
&ret))
return NULL;
break;
case NID_SRVName:
if (!X509V3_add_value_uchar("othername: SRVName:", gen->d.otherName->value->value.ia5string->data, &ret))
if (gen->d.otherName->value->type != V_ASN1_IA5STRING
|| !X509V3_add_value_uchar("othername: SRVName:",
gen->d.otherName->value->value.ia5string->data,
&ret))
return NULL;
break;
case NID_ms_upn:
if (!X509V3_add_value_uchar("othername: UPN:", gen->d.otherName->value->value.utf8string->data, &ret))
if (gen->d.otherName->value->type != V_ASN1_UTF8STRING
|| !X509V3_add_value_uchar("othername: UPN:",
gen->d.otherName->value->value.utf8string->data,
&ret))
return NULL;
break;
default:
@ -174,21 +186,36 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
{
unsigned char *p;
int i;
int i, nid;
switch (gen->type) {
case GEN_OTHERNAME:
switch (OBJ_obj2nid(gen->d.otherName->type_id)) {
nid = OBJ_obj2nid(gen->d.otherName->type_id);
/* Validate the types are as we expect before we use them */
if ((nid == NID_SRVName
&& gen->d.otherName->value->type != V_ASN1_IA5STRING)
|| (nid != NID_SRVName
&& gen->d.otherName->value->type != V_ASN1_UTF8STRING)) {
BIO_printf(out, "othername:<unsupported>");
break;
}
switch (nid) {
case NID_id_on_SmtpUTF8Mailbox:
BIO_printf(out, "othername:SmtpUTF8Mailbox:%s", gen->d.otherName->value->value.utf8string->data);
BIO_printf(out, "othername:SmtpUTF8Mailbox:%s",
gen->d.otherName->value->value.utf8string->data);
break;
case NID_XmppAddr:
BIO_printf(out, "othername:XmppAddr:%s", gen->d.otherName->value->value.utf8string->data);
BIO_printf(out, "othername:XmppAddr:%s",
gen->d.otherName->value->value.utf8string->data);
break;
case NID_SRVName:
BIO_printf(out, "othername:SRVName:%s", gen->d.otherName->value->value.ia5string->data);
BIO_printf(out, "othername:SRVName:%s",
gen->d.otherName->value->value.ia5string->data);
break;
case NID_ms_upn:
BIO_printf(out, "othername:UPN:%s", gen->d.otherName->value->value.utf8string->data);
BIO_printf(out, "othername:UPN:%s",
gen->d.otherName->value->value.utf8string->data);
break;
default:
BIO_printf(out, "othername:<unsupported>");

BIN
fuzz/corpora/x509/9901a721c7fe85b8208198cc5e77ac719f592577 Normal file
View File

Binary file not shown.