Skip to content

Commit 452652b

Browse files
padelsbachpadelsbach
committed
Add bounds check on wolfSSL_X509_notBefore and wolfSSL_X509_notAfter
1 parent ef3ba49 commit 452652b

5 files changed

Lines changed: 56 additions & 52 deletions

File tree

‎src/internal.c‎

Lines changed: 31 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -13743,11 +13743,34 @@ static int CopyREQAttributes(WOLFSSL_X509* x509, DecodedCert* dCert)
1374313743
}
1374413744
#endif /* WOLFSSL_CERT_REQ */
1374513745

13746+
/* Copy an ASN-encoded date (type + length + data) into a WOLFSSL_ASN1_TIME.
13747+
* srcDate: ASN date buffer where [0]=type, [1]=length, [2..]=date bytes.
13748+
* srcDateLen: total length of srcDate (0 means no date present). */
13749+
static void CopyDateToASN1_TIME(const byte* srcDate, int srcDateLen,
13750+
WOLFSSL_ASN1_TIME* dst)
13751+
{
13752+
if (srcDateLen >= 2) {
13753+
/* Clamp the date length to the maximum allowed size.
13754+
* This needs to match the size of WOLFSSL_ASN1_TIME minus the
13755+
* the type and length fields. */
13756+
const int maxSz = CTC_DATE_SIZE - 2;
13757+
const int copySz = (int)min(srcDate[1], maxSz);
13758+
dst->type = srcDate[0];
13759+
dst->length = copySz;
13760+
XMEMCPY(dst->data, &srcDate[2], copySz);
13761+
}
13762+
else {
13763+
dst->length = 0;
13764+
}
13765+
}
13766+
1374613767
/* Copy parts X509 needs from Decoded cert, 0 on success */
1374713768
int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
1374813769
{
1374913770
int ret = 0;
13771+
#ifdef WOLFSSL_SEP
1375013772
int minSz;
13773+
#endif
1375113774

1375213775
if (x509 == NULL || dCert == NULL ||
1375313776
dCert->subjectCNLen < 0)
@@ -13820,22 +13843,10 @@ int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
1382013843
x509->hwSerialNumSz = 0;
1382113844
#endif /* WOLFSSL_SEP */
1382213845

13823-
if (dCert->beforeDateLen > 0) {
13824-
minSz = (int)min(dCert->beforeDate[1], MAX_DATE_SZ);
13825-
x509->notBefore.type = dCert->beforeDate[0];
13826-
x509->notBefore.length = minSz;
13827-
XMEMCPY(x509->notBefore.data, &dCert->beforeDate[2], minSz);
13828-
}
13829-
else
13830-
x509->notBefore.length = 0;
13831-
if (dCert->afterDateLen > 0) {
13832-
minSz = (int)min(dCert->afterDate[1], MAX_DATE_SZ);
13833-
x509->notAfter.type = dCert->afterDate[0];
13834-
x509->notAfter.length = minSz;
13835-
XMEMCPY(x509->notAfter.data, &dCert->afterDate[2], minSz);
13836-
}
13837-
else
13838-
x509->notAfter.length = 0;
13846+
CopyDateToASN1_TIME(dCert->beforeDate, dCert->beforeDateLen,
13847+
&x509->notBefore);
13848+
CopyDateToASN1_TIME(dCert->afterDate, dCert->afterDateLen,
13849+
&x509->notAfter);
1383913850

1384013851
if (dCert->publicKey != NULL && dCert->pubKeySize != 0) {
1384113852
x509->pubKey.buffer = (byte*)XMALLOC(
@@ -14217,29 +14228,10 @@ int CopyDecodedAcertToX509(WOLFSSL_X509_ACERT* x509, DecodedAcert* dAcert)
1421714228
}
1421814229

1421914230
/* Copy before and after dates. */
14220-
{
14221-
int minSz = 0;
14222-
14223-
if (dAcert->beforeDateLen > 0) {
14224-
minSz = (int)min(dAcert->beforeDate[1], MAX_DATE_SZ);
14225-
x509->notBefore.type = dAcert->beforeDate[0];
14226-
x509->notBefore.length = minSz;
14227-
XMEMCPY(x509->notBefore.data, &dAcert->beforeDate[2], minSz);
14228-
}
14229-
else {
14230-
x509->notBefore.length = 0;
14231-
}
14232-
14233-
if (dAcert->afterDateLen > 0) {
14234-
minSz = (int)min(dAcert->afterDate[1], MAX_DATE_SZ);
14235-
x509->notAfter.type = dAcert->afterDate[0];
14236-
x509->notAfter.length = minSz;
14237-
XMEMCPY(x509->notAfter.data, &dAcert->afterDate[2], minSz);
14238-
}
14239-
else {
14240-
x509->notAfter.length = 0;
14241-
}
14242-
}
14231+
CopyDateToASN1_TIME(dAcert->beforeDate, dAcert->beforeDateLen,
14232+
&x509->notBefore);
14233+
CopyDateToASN1_TIME(dAcert->afterDate, dAcert->afterDateLen,
14234+
&x509->notAfter);
1424314235

1424414236
/* Copy the signature. */
1424514237
if (dAcert->signature != NULL && dAcert->sigLength != 0 &&

‎src/ssl_api_crl_ocsp.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -424,7 +424,7 @@ int wolfSSL_get_ocsp_producedDate_tm(WOLFSSL *ssl, struct tm *produced_tm) {
424424

425425
if (ExtractDate(ssl->ocspProducedDate,
426426
(unsigned char)ssl->ocspProducedDateFormat, produced_tm, &idx,
427-
MAX_DATE_SZ))
427+
MAX_DATE_SIZE))
428428
return 0;
429429
else
430430
return ASN_PARSE_E;

‎src/x509.c‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4419,8 +4419,14 @@ const byte* wolfSSL_X509_notBefore(WOLFSSL_X509* x509)
44194419
{
44204420
WOLFSSL_ENTER("wolfSSL_X509_notBefore");
44214421

4422-
if (x509 == NULL)
4422+
if (x509 == NULL) {
44234423
return NULL;
4424+
}
4425+
4426+
if (x509->notBefore.length < 0 ||
4427+
x509->notBefore.length > (int)sizeof(x509->notBeforeData) - 2) {
4428+
return NULL;
4429+
}
44244430

44254431
XMEMSET(x509->notBeforeData, 0, sizeof(x509->notBeforeData));
44264432
x509->notBeforeData[0] = (byte)x509->notBefore.type;
@@ -4437,8 +4443,14 @@ const byte* wolfSSL_X509_notAfter(WOLFSSL_X509* x509)
44374443
{
44384444
WOLFSSL_ENTER("wolfSSL_X509_notAfter");
44394445

4440-
if (x509 == NULL)
4446+
if (x509 == NULL) {
4447+
return NULL;
4448+
}
4449+
4450+
if (x509->notAfter.length < 0 ||
4451+
x509->notAfter.length > (int)sizeof(x509->notAfterData) - 2) {
44414452
return NULL;
4453+
}
44424454

44434455
XMEMSET(x509->notAfterData, 0, sizeof(x509->notAfterData));
44444456
x509->notAfterData[0] = (byte)x509->notAfter.type;
@@ -16060,6 +16072,10 @@ int wolfSSL_X509_set_notAfter(WOLFSSL_X509* x509, const WOLFSSL_ASN1_TIME* t)
1606016072
return WOLFSSL_FAILURE;
1606116073
}
1606216074

16075+
if (t->length < 0 || t->length > CTC_DATE_SIZE - 2) {
16076+
return WOLFSSL_FAILURE;
16077+
}
16078+
1606316079
x509->notAfter.type = t->type;
1606416080
x509->notAfter.length = t->length;
1606516081

@@ -16074,6 +16090,10 @@ int wolfSSL_X509_set_notBefore(WOLFSSL_X509* x509, const WOLFSSL_ASN1_TIME* t)
1607416090
return WOLFSSL_FAILURE;
1607516091
}
1607616092

16093+
if (t->length < 0 || t->length > CTC_DATE_SIZE - 2) {
16094+
return WOLFSSL_FAILURE;
16095+
}
16096+
1607716097
x509->notBefore.type = t->type;
1607816098
x509->notBefore.length = t->length;
1607916099

‎wolfssl/internal.h‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2471,10 +2471,6 @@ struct WOLFSSL_OCSP {
24712471
};
24722472
#endif
24732473

2474-
#ifndef MAX_DATE_SIZE
2475-
#define MAX_DATE_SIZE 32
2476-
#endif
2477-
24782474
typedef struct CRL_Entry CRL_Entry;
24792475

24802476
#if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
@@ -5312,10 +5308,6 @@ typedef struct Arrays {
53125308
#endif
53135309
#endif
53145310

5315-
#ifndef MAX_DATE_SZ
5316-
#define MAX_DATE_SZ 32
5317-
#endif
5318-
53195311
typedef enum {
53205312
STACK_TYPE_X509 = 0,
53215313
STACK_TYPE_GEN_NAME = 1,
@@ -6327,7 +6319,7 @@ struct WOLFSSL {
63276319
#endif /* HAVE_TLS_EXTENSIONS */
63286320
#ifdef HAVE_OCSP
63296321
void* ocspIOCtx;
6330-
byte ocspProducedDate[MAX_DATE_SZ];
6322+
byte ocspProducedDate[MAX_DATE_SIZE];
63316323
int ocspProducedDateFormat;
63326324
buffer ocspCsrResp[1 + MAX_CHAIN_DEPTH];
63336325
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)

‎wolfssl/wolfcrypt/asn.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1272,7 +1272,7 @@ enum Misc_ASN {
12721272
DSA_PARAM_INTS = 3, /* DSA parameter ints */
12731273
RSA_PUB_INTS = 2, /* RSA ints in public key */
12741274
MIN_DATE_SIZE = 12,
1275-
MAX_DATE_SIZE = 32,
1275+
MAX_DATE_SIZE = CTC_DATE_SIZE,
12761276
ASN_GEN_TIME_SZ = 15, /* 7 numbers * 2 + Zulu tag */
12771277

12781278
#ifdef WOLFSSL_CERT_GEN

0 commit comments

Comments
 (0)