Commit ae291421 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

pubkey_show: allocate buffer to fit any-size result 

The loop condition was wrong so keys larger than 340 bits would overflow
the local stack-based buffer.
parent cd045e24

lib/ssluse.c

+17 −13
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2010, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -1840,14 +1840,16 @@ static void pubkey_show(struct SessionHandle *data, 
                        unsigned char *raw,

                        int len)

{

  char buffer[1024];

  size_t left = sizeof(buffer);

  size_t left;

  int i;

  char *ptr=buffer;

  char namebuf[32];

  char *buffer;



  left = sizeof(len*3 + 1);

  buffer = malloc(left);

  if(buffer) {

    char *ptr=buffer;

    snprintf(namebuf, sizeof(namebuf), "%s(%s)", type, name);



    for(i=0; i< len; i++) {

      snprintf(ptr, left, "%02x:", raw[i]);

      ptr += 3;
@@ -1855,6 +1857,8 @@ static void pubkey_show(struct SessionHandle *data, 
    }

    infof(data, "   %s: %s\n", namebuf, buffer);

    push_certinfo(data, num, namebuf, buffer);

    free(buffer);

  }

}



#define print_pubkey_BN(_type, _name, _num)    \