Skip to content

Commit 08876e2

Browse files
miyazakhmiyazakh
committed
Fix CRL Number hex string buffer overflow in CRL parser
1 parent 6264c11 commit 08876e2

9 files changed

Lines changed: 208 additions & 10 deletions

File tree

‎certs/crl/extra-crls/large_crlnum.pem‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
Certificate Revocation List (CRL):
2+
Version 2 (0x1)
3+
Signature Algorithm: sha256WithRSAEncryption
4+
Issuer: C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com, emailAddress=info@wolfssl.com
5+
Last Update: Jan 8 07:15:25 2026 GMT
6+
Next Update: Oct 4 07:15:25 2028 GMT
7+
CRL extensions:
8+
X509v3 CRL Number:
9+
0xD8AFADA7F08B38E6178BD0E5CD7B0DF80071BA74
10+
Revoked Certificates:
11+
Serial Number: 01
12+
Revocation Date: Jan 8 07:15:25 2026 GMT
13+
Signature Algorithm: sha256WithRSAEncryption
14+
Signature Value:
15+
0c:45:a0:2e:ba:ad:28:48:eb:61:29:a6:fa:d0:76:8c:96:bb:
16+
1a:9a:79:90:05:06:78:8e:d2:f6:4d:6d:4c:75:62:d2:b2:91:
17+
f8:e4:59:a9:db:6f:e6:58:fe:f9:2e:7a:67:a7:01:a3:68:ee:
18+
b1:23:a6:25:2a:85:84:3d:bf:86:bf:6d:d5:a6:2d:03:8e:d1:
19+
ac:0f:73:4c:47:ea:fb:75:2e:85:1f:dc:fa:5e:b2:eb:d1:f4:
20+
75:e9:ae:a9:90:6e:ec:c9:05:db:61:39:30:a8:4e:c3:d2:ce:
21+
77:2d:ba:bf:fd:74:dc:c6:41:db:65:c4:83:66:9c:91:60:43:
22+
57:a3:52:bb:9c:b7:fa:30:d3:01:89:7f:5e:c8:06:0a:34:1b:
23+
77:ce:e8:b4:85:c5:6e:63:50:f3:88:cc:e3:54:7b:29:5c:08:
24+
4a:7b:35:b4:3f:01:2e:c5:93:4f:7c:7a:17:bf:0d:bd:be:3e:
25+
a9:1b:ef:a0:9c:bc:78:9e:91:99:91:e7:38:63:f1:24:86:02:
26+
63:81:cb:67:3a:f7:3c:5c:45:87:54:f4:9a:16:25:a2:e5:bd:
27+
ee:7e:9a:28:c0:db:4e:bc:4a:0d:c2:5f:14:ea:9c:8a:42:db:
28+
d2:1d:27:b8:d2:3c:57:4a:bf:46:4a:95:ac:7f:f4:47:22:dd:
29+
d5:dc:52:3f
30+
-----BEGIN X509 CRL-----
31+
MIICGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVTMRAwDgYD
32+
VQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhTYXd0b290
33+
aDETMBEGA1UECwwKQ29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29t
34+
MR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0yNjAxMDgwNzE1MjVa
35+
Fw0yODEwMDQwNzE1MjVaMBQwEgIBARcNMjYwMTA4MDcxNTI1WqAiMCAwHgYDVR0U
36+
BBcCFQDYr62n8Is45heL0OXNew34AHG6dDANBgkqhkiG9w0BAQsFAAOCAQEADEWg
37+
LrqtKEjrYSmm+tB2jJa7Gpp5kAUGeI7S9k1tTHVi0rKR+ORZqdtv5lj++S56Z6cB
38+
o2jusSOmJSqFhD2/hr9t1aYtA47RrA9zTEfq+3UuhR/c+l6y69H0demuqZBu7MkF
39+
22E5MKhOw9LOdy26v/103MZB22XEg2ackWBDV6NSu5y3+jDTAYl/XsgGCjQbd87o
40+
tIXFbmNQ84jM41R7KVwISns1tD8BLsWTT3x6F78Nvb4+qRvvoJy8eJ6RmZHnOGPx
41+
JIYCY4HLZzr3PFxFh1T0mhYlouW97n6aKMDbTrxKDcJfFOqcikLb0h0nuNI8V0q/
42+
RkqVrH/0RyLd1dxSPw==
43+
-----END X509 CRL-----

‎certs/crl/extra-crls/large_crlnum2.pem‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
Certificate Revocation List (CRL):
2+
Version 2 (0x1)
3+
Signature Algorithm: sha256WithRSAEncryption
4+
Issuer: C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com, emailAddress=info@wolfssl.com
5+
Last Update: Jan 8 07:15:25 2026 GMT
6+
Next Update: Oct 4 07:15:25 2028 GMT
7+
CRL extensions:
8+
X509v3 CRL Number:
9+
0x8BC28C3B3F7A6344CD464A9FDC837F2009DEB94FD3
10+
Revoked Certificates:
11+
Serial Number: 01
12+
Revocation Date: Jan 8 07:15:25 2026 GMT
13+
Signature Algorithm: sha256WithRSAEncryption
14+
Signature Value:
15+
47:71:aa:8d:29:11:90:57:c9:70:78:a5:de:40:ee:c3:da:81:
16+
68:d0:20:09:af:5b:5f:30:f9:69:14:ff:8a:cf:46:0d:e8:0d:
17+
45:df:1d:49:ce:05:01:28:a5:34:50:b6:cb:54:9d:a1:42:6c:
18+
f6:e2:66:de:be:e4:90:55:c1:83:e5:4c:26:96:43:29:39:84:
19+
ad:68:3c:0d:5a:d4:e7:ba:7c:21:e9:a1:c2:0c:ad:6f:0c:32:
20+
71:81:9f:df:7d:c3:0d:92:a4:6f:43:9f:8f:b7:ef:2d:6d:92:
21+
a6:17:cb:c7:4c:2e:3b:a5:2b:2c:74:fa:d1:be:6d:dc:19:04:
22+
d6:b6:56:6c:26:94:8e:13:15:29:12:fe:1a:a4:73:55:df:a5:
23+
c8:d3:d5:99:4a:c6:be:64:1f:90:a9:d8:94:d1:3b:b1:0e:ff:
24+
e4:81:d0:e5:a4:8a:a7:a9:82:fb:a6:86:be:e7:e1:a8:b5:0d:
25+
87:bb:76:5b:0e:05:1f:d4:82:3c:68:99:ec:ae:ae:8e:4a:72:
26+
cf:3f:8a:7f:b0:a2:69:d9:8c:68:7d:2f:3e:54:e9:fb:70:cf:
27+
d4:ed:1b:61:68:33:4f:93:9b:5f:5e:e9:de:e8:51:66:fd:c8:
28+
35:40:a0:7d:42:bd:d7:f4:96:cd:c8:72:14:84:cd:f5:19:8c:
29+
a0:5a:b7:72
30+
-----BEGIN X509 CRL-----
31+
MIICGjCCAQICAQEwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVTMRAwDgYD
32+
VQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhTYXd0b290
33+
aDETMBEGA1UECwwKQ29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29t
34+
MR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0yNjAxMDgwNzE1MjVa
35+
Fw0yODEwMDQwNzE1MjVaMBQwEgIBARcNMjYwMTA4MDcxNTI1WqAjMCEwHwYDVR0U
36+
BBgCFgCLwow7P3pjRM1GSp/cg38gCd65T9MwDQYJKoZIhvcNAQELBQADggEBAEdx
37+
qo0pEZBXyXB4pd5A7sPagWjQIAmvW18w+WkU/4rPRg3oDUXfHUnOBQEopTRQtstU
38+
naFCbPbiZt6+5JBVwYPlTCaWQyk5hK1oPA1a1Oe6fCHpocIMrW8MMnGBn999ww2S
39+
pG9Dn4+37y1tkqYXy8dMLjulKyx0+tG+bdwZBNa2VmwmlI4TFSkS/hqkc1XfpcjT
40+
1ZlKxr5kH5Cp2JTRO7EO/+SB0OWkiqepgvumhr7n4ai1DYe7dlsOBR/Ugjxomeyu
41+
ro5Kcs8/in+womnZjGh9Lz5U6ftwz9TtG2FoM0+Tm19e6d7oUWb9yDVAoH1Cvdf0
42+
ls3IchSEzfUZjKBat3I=
43+
-----END X509 CRL-----

‎certs/crl/gencrls.sh‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,4 +219,26 @@ openssl crl -in crl_rsapss.pem -text > tmp
219219
check_result $?
220220
mv tmp crl_rsapss.pem
221221

222+
echo "Step 29 large CRL number( = 20 octets )"
223+
echo d8afada7f08b38e6178bd0e5cd7b0df80071ba74 > crlnumber
224+
openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out extra-crls/large_crlnum.pem -keyfile ../ca-key.pem -cert ../ca-cert.pem
225+
check_result $?
226+
227+
# metadata
228+
echo "Step 29"
229+
openssl crl -in extra-crls/large_crlnum.pem -text > tmp
230+
check_result $?
231+
mv tmp extra-crls/large_crlnum.pem
232+
233+
echo "Step 30 large CRL number( > 20 octets )"
234+
echo 8bc28c3b3f7a6344cd464a9fdc837f2009deb94fd3 > crlnumber
235+
openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out extra-crls/large_crlnum2.pem -keyfile ../ca-key.pem -cert ../ca-cert.pem
236+
check_result $?
237+
238+
# metadata
239+
echo "Step 30"
240+
openssl crl -in extra-crls/large_crlnum2.pem -text > tmp
241+
check_result $?
242+
mv tmp extra-crls/large_crlnum2.pem
243+
222244
exit 0

‎src/crl.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
138138
crle->totalCerts = dcrl->totalCerts;
139139
crle->crlNumberSet = dcrl->crlNumberSet;
140140
if (crle->crlNumberSet) {
141-
XMEMCPY(crle->crlNumber, dcrl->crlNumber, CRL_MAX_NUM_SZ);
141+
XMEMCPY(crle->crlNumber, dcrl->crlNumber, CRL_MAX_NUM_HEX_STR_SZ);
142142
}
143143
crle->verified = verified;
144144
if (!verified) {
@@ -597,7 +597,7 @@ static void SetCrlInfo(CRL_Entry* entry, CrlInfo *info)
597597
info->nextDateFormat = entry->nextDateFormat;
598598
info->crlNumberSet = entry->crlNumberSet;
599599
if (info->crlNumberSet)
600-
XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_SZ);
600+
XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_HEX_STR_SZ);
601601
}
602602

603603
static void SetCrlInfoFromDecoded(DecodedCRL* entry, CrlInfo *info)
@@ -612,7 +612,7 @@ static void SetCrlInfoFromDecoded(DecodedCRL* entry, CrlInfo *info)
612612
info->nextDateFormat = entry->nextDateFormat;
613613
info->crlNumberSet = entry->crlNumberSet;
614614
if (info->crlNumberSet)
615-
XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_SZ);
615+
XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_HEX_STR_SZ);
616616
}
617617
#endif
618618

‎tests/api.c‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31518,6 +31518,58 @@ static int test_wolfSSL_CTX_LoadCRL(void)
3151831518
return EXPECT_RESULT();
3151931519
}
3152031520

31521+
static int test_wolfSSL_CTX_LoadCRL_largeCRLnum(void)
31522+
{
31523+
EXPECT_DECLS;
31524+
#if defined(HAVE_CRL) && !defined(NO_RSA) && !defined(NO_FILESYSTEM) && \
31525+
defined(HAVE_CRL_UPDATE_CB)
31526+
WOLFSSL_CERT_MANAGER* cm = NULL;
31527+
const char* caCert = "./certs/ca-cert.pem";
31528+
const char* crl_lrgcrlnum = "./certs/crl/extra-crls/large_crlnum.pem";
31529+
const char* crl_lrgcrlnum2 = "./certs/crl/extra-crls/large_crlnum2.pem";
31530+
const char* exp_crlnum = "D8AFADA7F08B38E6178BD0E5CD7B0DF80071BA74";
31531+
byte *crlLrgCrlNumBuff = NULL;
31532+
word32 crlLrgCrlNumSz;
31533+
CrlInfo crlInfo;
31534+
XFILE f;
31535+
word32 sz;
31536+
31537+
cm = wolfSSL_CertManagerNew();
31538+
ExpectNotNull(cm);
31539+
ExpectIntEQ(wolfSSL_CertManagerLoadCA(cm, caCert, NULL),
31540+
WOLFSSL_SUCCESS);
31541+
ExpectIntEQ(wolfSSL_CertManagerLoadCRLFile(cm, crl_lrgcrlnum,
31542+
WOLFSSL_FILETYPE_PEM),
31543+
WOLFSSL_SUCCESS);
31544+
31545+
AssertTrue((f = XFOPEN(crl_lrgcrlnum, "rb")) != XBADFILE);
31546+
AssertTrue(XFSEEK(f, 0, XSEEK_END) == 0);
31547+
AssertIntGE(sz = (word32) XFTELL(f), 1);
31548+
AssertTrue(XFSEEK(f, 0, XSEEK_SET) == 0);
31549+
AssertTrue( \
31550+
(crlLrgCrlNumBuff =
31551+
(byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_FILE)) != NULL);
31552+
AssertTrue(XFREAD(crlLrgCrlNumBuff, 1, sz, f) == sz);
31553+
XFCLOSE(f);
31554+
crlLrgCrlNumSz = sz;
31555+
31556+
AssertIntEQ(wolfSSL_CertManagerGetCRLInfo(
31557+
cm, &crlInfo, crlLrgCrlNumBuff, crlLrgCrlNumSz, WOLFSSL_FILETYPE_PEM),
31558+
WOLFSSL_SUCCESS);
31559+
AssertIntEQ(XMEMCMP(
31560+
crlInfo.crlNumber, exp_crlnum, XSTRLEN(exp_crlnum)), 0);
31561+
/* Expect to fail loading CRL because of >21 octets CRL number */
31562+
ExpectIntEQ(wolfSSL_CertManagerLoadCRLFile(cm, crl_lrgcrlnum2,
31563+
WOLFSSL_FILETYPE_PEM),
31564+
ASN_PARSE_E);
31565+
31566+
XFREE(crlLrgCrlNumBuff, NULL, DYNAMIC_TYPE_FILE);
31567+
wolfSSL_CertManagerFree(cm);
31568+
#endif
31569+
return EXPECT_RESULT();
31570+
31571+
}
31572+
3152131573
#if defined(HAVE_CRL) && !defined(NO_RSA) && !defined(NO_FILESYSTEM) && \
3152231574
defined(HAVE_CRL_UPDATE_CB)
3152331575
int crlUpdateTestStatus = 0;
@@ -31575,7 +31627,7 @@ static void updateCrlCb(CrlInfo* old, CrlInfo* cnew)
3157531627
AssertIntEQ(crl1Info.nextDateMaxLen, old->nextDateMaxLen);
3157631628
AssertIntEQ(crl1Info.nextDateFormat, old->nextDateFormat);
3157731629
AssertIntEQ(XMEMCMP(
31578-
crl1Info.crlNumber, old->crlNumber, CRL_MAX_NUM_SZ), 0);
31630+
crl1Info.crlNumber, old->crlNumber, CRL_MAX_NUM_HEX_STR_SZ), 0);
3157931631
AssertIntEQ(XMEMCMP(
3158031632
crl1Info.issuerHash, old->issuerHash, old->issuerHashLen), 0);
3158131633
AssertIntEQ(XMEMCMP(
@@ -31590,7 +31642,7 @@ static void updateCrlCb(CrlInfo* old, CrlInfo* cnew)
3159031642
AssertIntEQ(crlRevInfo.nextDateMaxLen, cnew->nextDateMaxLen);
3159131643
AssertIntEQ(crlRevInfo.nextDateFormat, cnew->nextDateFormat);
3159231644
AssertIntEQ(XMEMCMP(
31593-
crlRevInfo.crlNumber, cnew->crlNumber, CRL_MAX_NUM_SZ), 0);
31645+
crlRevInfo.crlNumber, cnew->crlNumber, CRL_MAX_NUM_HEX_STR_SZ), 0);
3159431646
AssertIntEQ(XMEMCMP(
3159531647
crlRevInfo.issuerHash, cnew->issuerHash, cnew->issuerHashLen), 0);
3159631648
AssertIntEQ(XMEMCMP(
@@ -42089,6 +42141,7 @@ TEST_CASE testCases[] = {
4208942141
TEST_DECL(test_wolfSSL_use_certificate_chain_file),
4209042142
TEST_DECL(test_wolfSSL_CTX_trust_peer_cert),
4209142143
TEST_DECL(test_wolfSSL_CTX_LoadCRL),
42144+
TEST_DECL(test_wolfSSL_CTX_LoadCRL_largeCRLnum),
4209242145
TEST_DECL(test_wolfSSL_crl_update_cb),
4209342146
TEST_DECL(test_wolfSSL_CTX_SetTmpDH_file),
4209442147
TEST_DECL(test_wolfSSL_CTX_SetTmpDH_buffer),

‎wolfcrypt/src/asn.c‎

Lines changed: 38 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40748,6 +40748,7 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
4074840748
word32* inOutIdx, word32 sz)
4074940749
{
4075040750
int length;
40751+
int needed;
4075140752
word32 idx;
4075240753
word32 ext_bound; /* boundary index for the sequence of extensions */
4075340754
word32 oid;
@@ -40853,7 +40854,24 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
4085340854

4085440855
if (ret != MP_OKAY)
4085540856
ret = BUFFER_E;
40856-
40857+
/* Check CRL number size
40858+
* if it exceeds CRL_MAX_NUM_SZ(octets)
40859+
*/
40860+
if (mp_unsigned_bin_size(m) > CRL_MAX_NUM_SZ) {
40861+
WOLFSSL_MSG("CRL number exceeds limitation.");
40862+
ret = BUFFER_E;
40863+
}
40864+
/* Determine required size for hexadecimal string encoding */
40865+
if (ret == MP_OKAY &&
40866+
(mp_radix_size(m, MP_RADIX_HEX, &needed) != MP_OKAY)) {
40867+
WOLFSSL_MSG("mp_radix_size failure");
40868+
ret = BUFFER_E;
40869+
}
40870+
if (ret == MP_OKAY && needed > CRL_MAX_NUM_HEX_STR_SZ) {
40871+
WOLFSSL_MSG("CRL number hex string"
40872+
" exceeds buffer limitation");
40873+
ret = BUFFER_E;
40874+
}
4085740875
if (ret == MP_OKAY && mp_toradix(m, (char*)dcrl->crlNumber,
4085840876
MP_RADIX_HEX) != MP_OKAY)
4085940877
ret = BUFFER_E;
@@ -40891,6 +40909,7 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf, word32 idx,
4089140909
word32 maxIdx)
4089240910
{
4089340911
DECL_ASNGETDATA(dataASN, certExtASN_Length);
40912+
int needed;
4089440913
int ret = 0;
4089540914
/* Track if we've seen these extensions already */
4089640915
word32 seenAuthKey = 0;
@@ -40970,7 +40989,24 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf, word32 idx,
4097040989
if (ret == 0) {
4097140990
ret = GetInt(m, buf, &localIdx, maxIdx);
4097240991
}
40973-
40992+
/* Check CRL number size
40993+
* if it exceeds CRL_MAX_NUM_SZ(octets)
40994+
*/
40995+
if (mp_unsigned_bin_size(m) > CRL_MAX_NUM_SZ) {
40996+
WOLFSSL_MSG("CRL number exceeds limitation.");
40997+
ret = BUFFER_E;
40998+
}
40999+
/* Determine required size for hexadecimal string encoding */
41000+
if (ret == MP_OKAY &&
41001+
(mp_radix_size(m, MP_RADIX_HEX, &needed) != MP_OKAY)) {
41002+
WOLFSSL_MSG("mp_radix_size failure");
41003+
ret = BUFFER_E;
41004+
}
41005+
if (ret == MP_OKAY && needed > CRL_MAX_NUM_HEX_STR_SZ) {
41006+
WOLFSSL_MSG("CRL number hex string"
41007+
" exceeds buffer limitation");
41008+
ret = BUFFER_E;
41009+
}
4097441010
if (ret == 0 && mp_toradix(m, (char*)dcrl->crlNumber,
4097541011
MP_RADIX_HEX) != MP_OKAY)
4097641012
ret = BUFFER_E;

‎wolfssl/internal.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2504,7 +2504,7 @@ struct CRL_Entry {
25042504
/* DupCRL_Entry copies data after the `verifyMutex` member. Using the mutex
25052505
* as the marker because clang-tidy doesn't like taking the sizeof a
25062506
* pointer. */
2507-
byte crlNumber[CRL_MAX_NUM_SZ]; /* CRL number extension */
2507+
byte crlNumber[CRL_MAX_NUM_HEX_STR_SZ]; /* CRL number extension */
25082508
byte issuerHash[CRL_DIGEST_SIZE]; /* issuer hash */
25092509
/* byte crlHash[CRL_DIGEST_SIZE]; raw crl data hash */
25102510
/* restore the hash here if needed for optimized comparisons */

‎wolfssl/ssl.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3795,7 +3795,7 @@ typedef int (*CbCrlIO)(WOLFSSL_CRL* crl, const char* url, int urlSz);
37953795

37963796
#ifdef HAVE_CRL_UPDATE_CB
37973797
typedef struct CrlInfo {
3798-
byte crlNumber[CRL_MAX_NUM_SZ];
3798+
byte crlNumber[CRL_MAX_NUM_HEX_STR_SZ];
37993799
byte *issuerHash;
38003800
word32 issuerHashLen;
38013801
byte *lastDate;

‎wolfssl/wolfcrypt/asn.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2693,6 +2693,7 @@ struct RevokedCert {
26932693
#define CRL_MAX_NUM_SZ 20 /* RFC5280 states that CRL number can be up to 20 */
26942694
#endif /* octets long */
26952695

2696+
#define CRL_MAX_NUM_HEX_STR_SZ (CRL_MAX_NUM_SZ * 2 + 1)
26962697

26972698
typedef struct DecodedCRL DecodedCRL;
26982699

@@ -2706,7 +2707,7 @@ struct DecodedCRL {
27062707
word32 sigParamsLength; /* length of signature parameters */
27072708
#endif
27082709
byte* signature; /* pointer into raw source, not owned */
2709-
byte crlNumber[CRL_MAX_NUM_SZ]; /* CRL number extension */
2710+
byte crlNumber[CRL_MAX_NUM_HEX_STR_SZ]; /* CRL number extension */
27102711
byte issuerHash[SIGNER_DIGEST_SIZE]; /* issuer name hash */
27112712
byte crlHash[SIGNER_DIGEST_SIZE]; /* raw crl data hash */
27122713
byte lastDate[MAX_DATE_SIZE]; /* last date updated */

0 commit comments

Comments
 (0)