From e7ff797e7e214c5ddeed1e22250aea3a32bb47d9 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Fri, 13 Sep 2019 14:21:13 +0100 Subject: [PATCH] X.509: Add length consistency checks to x509_get_other_name() Signed-off-by: Andrzej Kurek --- library/x509_crt.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/library/x509_crt.c b/library/x509_crt.c index c4bb3aebf8..bc7818a012 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -1756,11 +1756,21 @@ static int x509_get_other_name(const mbedtls_x509_buf *subject_alt_name, return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret); } + if (end != p + len) { + return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); + } + if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) { return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret); } + if (end != p + len) { + return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); + } + if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID)) != 0) { return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret); }