Fix various read buffer overflow when printing ASN.1 strings (which are

not necessarily NUL terminated). Same as schwarze's fix in t_x509a.c r1.9.

From David Benjamin and Matt Caswell (part of the fixes in OpenSSL 1.1.1l)

ok inoguchi

diff --git a/lib/libcrypto/asn1/t_spki.c b/lib/libcrypto/asn1/t_spki.c
index 39ff067..7f1ed12 100644 (file)
--- a/lib/libcrypto/asn1/t_spki.c
+++ b/lib/libcrypto/asn1/t_spki.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_spki.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: t_spki.c,v 1.12 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -94,7 +94,8 @@ NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
        }
        chal = spki->spkac->challenge;
        if (chal->length)
-               BIO_printf(out, "  Challenge String: %s\n", chal->data);
+               BIO_printf(out, "  Challenge String: %.*s\n", chal->length,
+                   chal->data);
        i = OBJ_obj2nid(spki->sig_algor->algorithm);
        BIO_printf(out, "  Signature Algorithm: %s",
            (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));

diff --git a/lib/libcrypto/x509/x509_alt.c b/lib/libcrypto/x509/x509_alt.c
index 45aaec2..5b9f490 100644 (file)
--- a/lib/libcrypto/x509/x509_alt.c
+++ b/lib/libcrypto/x509/x509_alt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_alt.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_alt.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -264,15 +264,18 @@ GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
                break;
 
        case GEN_EMAIL:
-               BIO_printf(out, "email:%s", gen->d.ia5->data);
+               BIO_printf(out, "email:%.*s", gen->d.ia5->length,
+                   gen->d.ia5->data);
                break;
 
        case GEN_DNS:
-               BIO_printf(out, "DNS:%s", gen->d.ia5->data);
+               BIO_printf(out, "DNS:%.*s", gen->d.ia5->length,
+                   gen->d.ia5->data);
                break;
 
        case GEN_URI:
-               BIO_printf(out, "URI:%s", gen->d.ia5->data);
+               BIO_printf(out, "URI:%.*s", gen->d.ia5->length,
+                   gen->d.ia5->data);
                break;
 
        case GEN_DIRNAME:

diff --git a/lib/libcrypto/x509/x509_cpols.c b/lib/libcrypto/x509/x509_cpols.c
index 4b6c13c..2ace607 100644 (file)
--- a/lib/libcrypto/x509/x509_cpols.c
+++ b/lib/libcrypto/x509/x509_cpols.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_cpols.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_cpols.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -696,7 +696,8 @@ print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals, int indent)
                qualinfo = sk_POLICYQUALINFO_value(quals, i);
                switch (OBJ_obj2nid(qualinfo->pqualid)) {
                case NID_id_qt_cps:
-                       BIO_printf(out, "%*sCPS: %s\n", indent, "",
+                       BIO_printf(out, "%*sCPS: %.*s\n", indent, "",
+                           qualinfo->d.cpsuri->length,
                            qualinfo->d.cpsuri->data);
                        break;
 
@@ -724,8 +725,8 @@ print_notice(BIO *out, USERNOTICE *notice, int indent)
        if (notice->noticeref) {
                NOTICEREF *ref;
                ref = notice->noticeref;
-               BIO_printf(out, "%*sOrganization: %s\n", indent, "",
-                   ref->organization->data);
+               BIO_printf(out, "%*sOrganization: %.*s\n", indent, "",
+                   ref->organization->length, ref->organization->data);
                BIO_printf(out, "%*sNumber%s: ", indent, "",
                    sk_ASN1_INTEGER_num(ref->noticenos) > 1 ? "s" : "");
                for (i = 0; i < sk_ASN1_INTEGER_num(ref->noticenos); i++) {
@@ -741,8 +742,8 @@ print_notice(BIO *out, USERNOTICE *notice, int indent)
                BIO_puts(out, "\n");
        }
        if (notice->exptext)
-               BIO_printf(out, "%*sExplicit Text: %s\n", indent, "",
-                   notice->exptext->data);
+               BIO_printf(out, "%*sExplicit Text: %.*s\n", indent, "",
+                   notice->exptext->length, notice->exptext->data);
 }
 
 void

diff --git a/lib/libcrypto/x509/x509_pci.c b/lib/libcrypto/x509/x509_pci.c
index 8997f0c..b1d31df 100644 (file)
--- a/lib/libcrypto/x509/x509_pci.c
+++ b/lib/libcrypto/x509/x509_pci.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_pci.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_pci.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Contributed to the OpenSSL Project 2004
  * by Richard Levitte (richard@levitte.org)
  */
@@ -77,7 +77,8 @@ i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci, BIO *out,
        i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
        BIO_puts(out, "\n");
        if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
-               BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
+               BIO_printf(out, "%*sPolicy Text: %.*s\n", indent, "",
+                   pci->proxyPolicy->policy->length,
                    pci->proxyPolicy->policy->data);
        return 1;
 }