eden-emu/mbedtls
20
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix potential buffer overflow in asn1write

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-10-21 12:07:47 +02:00
parent 9dc66f4b2f
commit 0d66bb959f
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
library/asn1write.c
View file

@ -87,7 +87,7 @@ int mbedtls_asn1_write_raw_buffer( unsigned char **p, unsigned char *start,
{
size_t len = 0;
if( *p - start < (int) size )
if( *p < start || (size_t)( *p - start ) < size )
return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
len = size;
@ -107,7 +107,7 @@ int mbedtls_asn1_write_mpi( unsigned char **p, unsigned char *start, const mbedt
//
len = mbedtls_mpi_size( X );
if( *p - start < (int) len )
if( *p < start || (size_t)( *p - start ) < len )
return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
(*p) -= len;
@ -270,7 +270,7 @@ int mbedtls_asn1_write_bitstring( unsigned char **p, unsigned char *start,
// Calculate byte length
//
if( *p - start < (int) size + 1 )
if( *p < start || (size_t)( *p - start ) < size + 1 )
return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
len = size + 1;