Commit f021b7cc authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Reject BMPStrings and UniversalStrings of invalid length. This prevents 

a crash in ASN1_STRING_print_ex() which assumes they are valid.
parent c126b73a

CHANGES

+5 −0
Original line number Diff line number Diff line
@@ -4,6 +4,11 @@ 


 Changes between 0.9.8j and 0.9.8k  [xx XXX xxxx]



  *) Reject UniversalString and BMPString types with invalid lengths. This

     prevents a crash in ASN1_STRING_print_ex() which assumes the strings have

     a legal length. (CVE-2009-0590)

     [Steve Henson]



  *) Set S/MIME signing as the default purpose rather than setting it 

     unconditionally. This allows applications to override it at the store

     level.

crypto/asn1/asn1.h

+2 −0
Original line number Diff line number Diff line
@@ -1218,6 +1218,7 @@ void ERR_load_ASN1_strings(void); 
#define ASN1_R_BAD_OBJECT_HEADER			 102

#define ASN1_R_BAD_PASSWORD_READ			 103

#define ASN1_R_BAD_TAG					 104

#define ASN1_R_BMPSTRING_IS_WRONG_LENGTH		 210

#define ASN1_R_BN_LIB					 105

#define ASN1_R_BOOLEAN_IS_WRONG_LENGTH			 106

#define ASN1_R_BUFFER_TOO_SMALL				 107
@@ -1307,6 +1308,7 @@ void ERR_load_ASN1_strings(void); 
#define ASN1_R_UNABLE_TO_DECODE_RSA_KEY			 157

#define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY		 158

#define ASN1_R_UNEXPECTED_EOC				 159

#define ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH		 211

#define ASN1_R_UNKNOWN_FORMAT				 160

#define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM		 161

#define ASN1_R_UNKNOWN_OBJECT_TYPE			 162

crypto/asn1/asn1_err.c

+2 −0
Original line number Diff line number Diff line
@@ -195,6 +195,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]= 
{ERR_REASON(ASN1_R_BAD_OBJECT_HEADER)    ,"bad object header"},

{ERR_REASON(ASN1_R_BAD_PASSWORD_READ)    ,"bad password read"},

{ERR_REASON(ASN1_R_BAD_TAG)              ,"bad tag"},

{ERR_REASON(ASN1_R_BMPSTRING_IS_WRONG_LENGTH),"bmpstring is wrong length"},

{ERR_REASON(ASN1_R_BN_LIB)               ,"bn lib"},

{ERR_REASON(ASN1_R_BOOLEAN_IS_WRONG_LENGTH),"boolean is wrong length"},

{ERR_REASON(ASN1_R_BUFFER_TOO_SMALL)     ,"buffer too small"},
@@ -284,6 +285,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]= 
{ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_KEY),"unable to decode rsa key"},

{ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY),"unable to decode rsa private key"},

{ERR_REASON(ASN1_R_UNEXPECTED_EOC)       ,"unexpected eoc"},

{ERR_REASON(ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH),"universalstring is wrong length"},

{ERR_REASON(ASN1_R_UNKNOWN_FORMAT)       ,"unknown format"},

{ERR_REASON(ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM),"unknown message digest algorithm"},

{ERR_REASON(ASN1_R_UNKNOWN_OBJECT_TYPE)  ,"unknown object type"},

crypto/asn1/tasn_dec.c

+12 −0
Original line number Diff line number Diff line
@@ -1012,6 +1012,18 @@ int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, 
		case V_ASN1_SET:

		case V_ASN1_SEQUENCE:

		default:

		if (utype == V_ASN1_BMPSTRING && (len & 1))

			{

			ASN1err(ASN1_F_ASN1_EX_C2I,

					ASN1_R_BMPSTRING_IS_WRONG_LENGTH);

			goto err;

			}

		if (utype == V_ASN1_UNIVERSALSTRING && (len & 3))

			{

			ASN1err(ASN1_F_ASN1_EX_C2I,

					ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH);

			goto err;

			}

		/* All based on ASN1_STRING and handled the same */

		if (!*pval)

			{