diff options
| author | Nick Mathewson <nickm@torproject.org> | 2015-10-21 11:44:43 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2015-10-21 11:44:43 -0400 |
| commit | 35bf07b8d67d018f7740ca195cf8c7c86b1b4ef9 (patch) | |
| tree | 96ab072a93a2d30f4723383607a5169f35d1546c /src/common | |
| parent | 62b02a1941c6c51efe36f804ddd10f62a3606d41 (diff) | |
| download | tor-35bf07b8d67d018f7740ca195cf8c7c86b1b4ef9.tar.gz tor-35bf07b8d67d018f7740ca195cf8c7c86b1b4ef9.zip | |
Check for len < 4 in dn_indicates_v3_cert
Without this check, we potentially look up to 3 characters before
the start of a malloc'd segment, which could provoke a crash under
certain (weird afaik) circumstances.
Fixes 17404; bugfix on 0.2.6.3-alpha.
Diffstat (limited to 'src/common')
| -rw-r--r-- | src/common/tortls.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/common/tortls.c b/src/common/tortls.c index 4222f6dbff..75ca47dbdb 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2676,6 +2676,10 @@ dn_indicates_v3_cert(X509_NAME *name) len = ASN1_STRING_to_UTF8(&s, str); if (len < 0) return 0; + if (len < 4) { + OPENSSL_free(s); + return 0; + } r = fast_memneq(s + len - 4, ".net", 4); OPENSSL_free(s); return r; |