From b17444b3c47e32c77a3ba5335ae30ccbadcba3cf Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Tue, 22 Nov 2022 16:36:46 +0100 Subject: [PATCH] Fix an integer overflow in the CRL signature parser. * src/crl.c (parse_signature): N+N2 now checked for overflow. * src/ocsp.c (parse_response_extensions): Do not accept too large values. (parse_single_extensions): Ditto. -- The second patch is an extra safegourd not related to the reported bug. GnuPG-bug-id: 6284 Reported-by: Joseph Surin, elttam CVE: CVE-2022-47629 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070 Upstream-Status: Backport Signed-off-by: Chee Yang Lee --- src/crl.c | 2 +- src/ocsp.c | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/crl.c b/src/crl.c index 87a3fa3..9d3028e 100644 --- a/src/crl.c +++ b/src/crl.c @@ -1434,7 +1434,7 @@ parse_signature (ksba_crl_t crl) && !ti.is_constructed) ) return gpg_error (GPG_ERR_INV_CRL_OBJ); n2 = ti.nhdr + ti.length; - if (n + n2 >= DIM(tmpbuf)) + if (n + n2 >= DIM(tmpbuf) || (n + n2) < n) return gpg_error (GPG_ERR_TOO_LARGE); memcpy (tmpbuf+n, ti.buf, ti.nhdr); err = read_buffer (crl->reader, tmpbuf+n+ti.nhdr, ti.length); diff --git a/src/ocsp.c b/src/ocsp.c index 4b26f8d..c41234e 100644 --- a/src/ocsp.c +++ b/src/ocsp.c @@ -912,6 +912,12 @@ parse_response_extensions (ksba_ocsp_t ocsp, else ocsp->good_nonce = 1; } + if (ti.length > (1<<24)) + { + /* Bail out on much too large objects. */ + err = gpg_error (GPG_ERR_BAD_BER); + goto leave; + } ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length); if (!ex) { @@ -979,6 +985,12 @@ parse_single_extensions (struct ocsp_reqitem_s *ri, err = parse_octet_string (&data, &datalen, &ti); if (err) goto leave; + if (ti.length > (1<<24)) + { + /* Bail out on much too large objects. */ + err = gpg_error (GPG_ERR_BAD_BER); + goto leave; + } ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length); if (!ex) {