eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix potential heap corruption on Windows

Browse source 
If len is large enough, when cast to an int it will be negative and then the
test if( len > MAX_PATH - 3 ) will not behave as expected.
This commit is contained in:
Manuel Pégourié-Gonnard 2015-10-21 10:16:29 +02:00 • committed by Manuel Pégourié-Gonnard
parent cdea97c1c3
commit 261faed725
2 changed files with 9 additions and 2 deletions
library
x509_crt.c

4
library/x509_crt.c
View file

@ -1097,7 +1097,7 @@ int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path )
WCHAR szDir[MAX_PATH];
char filename[MAX_PATH];
char *p;
int len = (int) strlen( path );
size_t len = strlen( path );
WIN32_FIND_DATAW file_data;
HANDLE hFind;
@ -1131,7 +1131,7 @@ int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path )
w_ret = WideCharToMultiByte( CP_ACP, 0, file_data.cFileName,
lstrlenW( file_data.cFileName ),
p, len - 1,
p, (int) len - 1,
NULL, NULL );
if( w_ret == 0 )
return( MBEDTLS_ERR_X509_FILE_IO_ERROR );