author | Ann Lai <ann.lai@oracle.com> |
Thu, 30 Jul 2015 17:45:10 -0700 | |
changeset 4723 | 4193dfeb0e39 |
permissions | -rw-r--r-- |
4723
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
1 |
Source: |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
2 |
Internal |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
3 |
|
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
4 |
Info: |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
5 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468 |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
6 |
The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
7 |
report an error when a negative bit length is identified, which allows |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
8 |
context-dependent attackers to cause out-of-bounds access via crafted ASN.1 |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
9 |
data. |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
10 |
|
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
11 |
Status: |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
12 |
Need to determine if this patch has been sent upstream. |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
13 |
|
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
14 |
--- libtasn1-2.8/lib/decoding.c.orig 2014-06-05 10:36:51.728076396 +0530 |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
15 |
+++ libtasn1-2.8/lib/decoding.c 2014-06-05 10:39:39.072295803 +0530 |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
16 |
@@ -214,7 +214,7 @@ asn1_get_octet_der (const unsigned char |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
17 |
int *ret_len, unsigned char *str, int str_size, |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
18 |
int *str_len) |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
19 |
{ |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
20 |
- int len_len; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
21 |
+ int len_len = 0; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
22 |
|
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
23 |
if (der_len <= 0) |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
24 |
return ASN1_GENERIC_ERROR; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
25 |
@@ -335,7 +335,7 @@ asn1_get_bit_der (const unsigned char *d |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
26 |
int *ret_len, unsigned char *str, int str_size, |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
27 |
int *bit_len) |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
28 |
{ |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
29 |
- int len_len, len_byte; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
30 |
+ int len_len = 0, len_byte; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
31 |
|
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
32 |
if (der_len <= 0) |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
33 |
return ASN1_GENERIC_ERROR; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
34 |
@@ -346,6 +346,9 @@ asn1_get_bit_der (const unsigned char *d |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
35 |
*ret_len = len_byte + len_len + 1; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
36 |
*bit_len = len_byte * 8 - der[len_len]; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
37 |
|
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
38 |
+ if (*bit_len <= 0) |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
39 |
+ return ASN1_DER_ERROR; |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
40 |
+ |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
41 |
if (str_size >= len_byte) |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
42 |
memcpy (str, der + len_len + 1, len_byte); |
4193dfeb0e39
21124729 Move libtasn1 from Desktop to Userland consolidation
Ann Lai <ann.lai@oracle.com>
parents:
diff
changeset
|
43 |
else |