src/go.mod: import x/crypto/cryptobyte security fix for 32-bit archs

	cryptobyte: fix panic due to malformed ASN.1 inputs on 32-bit archs

	When int is 32 bits wide (on 32-bit architectures like 386 and arm), an
	overflow could occur, causing a panic, due to malformed ASN.1 being
	passed to any of the ASN1 methods of String.

	Tested on linux/386 and darwin/amd64.

	This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof
	test vectors.

	Change-Id: I8c9696a8bfad1b40ec877cd740dba3467d66ab54
	Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/645211
	Reviewed-by: Katie Hockman <katiehockman@google.com>
	Reviewed-by: Adam Langley <agl@google.com>
	Reviewed-on: https://go-review.googlesource.com/c/crypto/+/216677
	Run-TryBot: Katie Hockman <katie@golang.org>
	Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
	Reviewed-by: Filippo Valsorda <filippo@golang.org>
	TryBot-Result: Gobot Gobot <gobot@golang.org>

x/crypto/cryptobyte is used in crypto/x509 for parsing certificates.
Malformed certificates might cause a panic during parsing on 32-bit
architectures (like arm and 386).

Change-Id: I840feb54eba880dbb96780ef7adcade073c4c4e3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/647741
Reviewed-by: Katie Hockman <katiehockman@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/216680
Reviewed-by: Katie Hockman <katie@golang.org>

3 files changed, 5 insertions, 9 deletions

diff --git a/src/vendor/golang.org/x/crypto/cryptobyte/asn1.go b/src/vendor/golang.org/x/crypto/cryptobyte/asn1.go
index 528b9bff67..f930f7e526 100644
--- a/src/vendor/golang.org/x/crypto/cryptobyte/asn1.go
+++ b/src/vendor/golang.org/x/crypto/cryptobyte/asn1.go
@@ -470,7 +470,8 @@ func (s *String) ReadASN1GeneralizedTime(out *time.Time) bool {
 // It reports whether the read was successful.
 func (s *String) ReadASN1BitString(out *encoding_asn1.BitString) bool {
 	var bytes String
-	if !s.ReadASN1(&bytes, asn1.BIT_STRING) || len(bytes) == 0 {
+	if !s.ReadASN1(&bytes, asn1.BIT_STRING) || len(bytes) == 0 ||
+		len(bytes)*8/8 != len(bytes) {
 		return false
 	}
 
@@ -740,7 +741,7 @@ func (s *String) readASN1(out *String, outTag *asn1.Tag, skipHeader bool) bool {
 		length = headerLen + len32
 	}
 
-	if uint32(int(length)) != length || !s.ReadBytes((*[]byte)(out), int(length)) {
+	if int(length) < 0 || !s.ReadBytes((*[]byte)(out), int(length)) {
 		return false
 	}
 	if skipHeader && !out.Skip(int(headerLen)) {
diff --git a/src/vendor/golang.org/x/crypto/cryptobyte/string.go b/src/vendor/golang.org/x/crypto/cryptobyte/string.go
index 39bf98aeea..589d297e6b 100644
--- a/src/vendor/golang.org/x/crypto/cryptobyte/string.go
+++ b/src/vendor/golang.org/x/crypto/cryptobyte/string.go
@@ -24,7 +24,7 @@ type String []byte
 // read advances a String by n bytes and returns them. If less than n bytes
 // remain, it returns nil.
 func (s *String) read(n int) []byte {
-	if len(*s) < n {
+	if len(*s) < n || n < 0 {
 		return nil
 	}
 	v := (*s)[:n]
@@ -105,11 +105,6 @@ func (s *String) readLengthPrefixed(lenLen int, outChild *String) bool {
 		length = length << 8
 		length = length | uint32(b)
 	}
-	if int(length) < 0 {
-		// This currently cannot overflow because we read uint24 at most, but check
-		// anyway in case that changes in the future.
-		return false
-	}
 	v := s.read(int(length))
 	if v == nil {
 		return false
diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
index ba6bd9845c..0944c9a533 100644
--- a/src/vendor/modules.txt
+++ b/src/vendor/modules.txt
@@ -1,4 +1,4 @@
-# golang.org/x/crypto v0.0.0-20200109152110-61a87790db17
+# golang.org/x/crypto v0.0.0-20200128174031-69ecbb4d6d5d
 ## explicit
 golang.org/x/crypto/chacha20
 golang.org/x/crypto/chacha20poly1305