diff options
| author | Nick Mathewson <nickm@torproject.org> | 2015-10-21 11:51:03 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2015-10-21 11:51:03 -0400 |
| commit | b809c265e77f4528b59aa3932a3cde8bf5e19fb3 (patch) | |
| tree | 98ec84a364d26b4a21b7fefa4084b687f7a44485 | |
| parent | 9c4a0aef0c0d8e1c3ad8d9ed7b655eae8a175ccb (diff) | |
| parent | 35bf07b8d67d018f7740ca195cf8c7c86b1b4ef9 (diff) | |
| download | tor-b809c265e77f4528b59aa3932a3cde8bf5e19fb3.tar.gz tor-b809c265e77f4528b59aa3932a3cde8bf5e19fb3.zip | |
Merge remote-tracking branch 'public/bug17404_024' into maint-0.2.7
| -rw-r--r-- | changes/bug17404 | 6 | ||||
| -rw-r--r-- | src/common/tortls.c | 4 |
2 files changed, 10 insertions, 0 deletions
diff --git a/changes/bug17404 b/changes/bug17404 new file mode 100644 index 0000000000..d524f6662d --- /dev/null +++ b/changes/bug17404 @@ -0,0 +1,6 @@ + o Major bugfixes (security, correctness): + - Fix a programming error that could cause us to read 4 bytes before + the beginning of an openssl string. This could be used to provoke + a crash on systems with an unusual malloc implementation, or + systems with unsual hardening installed. Fixes bug 17404; bugfix + on 0.2.3.6-alpha. diff --git a/src/common/tortls.c b/src/common/tortls.c index 97d0ce2d4c..b597fe2331 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2521,6 +2521,10 @@ dn_indicates_v3_cert(X509_NAME *name) len = ASN1_STRING_to_UTF8(&s, str); if (len < 0) return 0; + if (len < 4) { + OPENSSL_free(s); + return 0; + } r = fast_memneq(s + len - 4, ".net", 4); OPENSSL_free(s); return r; |