diff options
| author | bonniegong <46280630+bonniegong@users.noreply.github.com> | 2021-04-12 04:43:13 +0200 |
|---|---|---|
| committer | Pauli <pauli@openssl.org> | 2021-05-14 02:13:53 +0200 |
| commit | c65abf2213117eb5348a46fbc18f706aca052e85 (patch) | |
| tree | 77e082d5863f0ece9df26197890a0a63f28ff95a /crypto/asn1 | |
| parent | http_client.c: Fix inconsistency w.r.t. type of max_resp_len (diff) | |
| download | openssl-c65abf2213117eb5348a46fbc18f706aca052e85.tar.xz openssl-c65abf2213117eb5348a46fbc18f706aca052e85.zip | |
check i2d_ASN1_TYPE return value
add a length check to the return value of function i2d_ASN1_TYPE. Return an error instead of trying to malloc a negative number.
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14828)
Diffstat (limited to 'crypto/asn1')
| -rw-r--r-- | crypto/asn1/a_strex.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c index b9b6f1c871..b31761aae6 100644 --- a/crypto/asn1/a_strex.c +++ b/crypto/asn1/a_strex.c @@ -280,6 +280,8 @@ static int do_dump(unsigned long lflags, char_io *io_ch, void *arg, t.type = str->type; t.value.ptr = (char *)str; der_len = i2d_ASN1_TYPE(&t, NULL); + if (der_len <= 0) + return -1; if ((der_buf = OPENSSL_malloc(der_len)) == NULL) { ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE); return -1; |