Commit 109566a
crypto: fix missing error checks on ASN1_STRING_to_UTF8()
This function returns a negative error code on error.
When it does so, the `value_str` pointer will remain uninitialized
and cause a crash later on when it is freed by OPENSSL_free().
Even if it wouldn't crash there, it still fails to signal the error
and an empty string may be propagated to the callers.
The check also mirrors the other one in the same file.
Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: #65200
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>1 parent eb5d66e commit 109566a
1 file changed
Lines changed: 3 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -6908,6 +6908,9 @@ std::pair<std::string, std::string> X509Name::Iterator::operator*() const { | |||
| 6908 | 6908 | ||
| 6909 | 6909 | unsigned char* value_str; | |
| 6910 | 6910 | int value_str_size = ASN1_STRING_to_UTF8(&value_str, value); | |
| 6911 | + if (value_str_size < 0) [[unlikely]] { | ||
| 6912 | + return {{}, {}}; | ||
| 6913 | + } | ||
| 6911 | 6914 | ||
| 6912 | 6915 | std::string out(reinterpret_cast<const char*>(value_str), value_str_size); | |
| 6913 | 6916 | OPENSSL_free(value_str); // free after copy | |
0 commit comments