From: tb <tb@openbsd.org>
Date: Tue, 24 Aug 2021 15:23:03 +0000 (+0000)
Subject: Fix various read buffer overflow when printing ASN.1 strings (which are
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=3d508f29e57b079dbcf0484f850c5fb0063888ca;p=openbsd

Fix various read buffer overflow when printing ASN.1 strings (which are
not necessarily NUL terminated). Same as schwarze's fix in t_x509a.c r1.9.

From David Benjamin and Matt Caswell (part of the fixes in OpenSSL 1.1.1l)

ok inoguchi
---

diff --git a/lib/libcrypto/asn1/t_spki.c b/lib/libcrypto/asn1/t_spki.c
index 39ff0670b6d..7f1ed129cfc 100644
--- a/lib/libcrypto/asn1/t_spki.c
+++ b/lib/libcrypto/asn1/t_spki.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_spki.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: t_spki.c,v 1.12 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -94,7 +94,8 @@ NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
 	}
 	chal = spki->spkac->challenge;
 	if (chal->length)
-		BIO_printf(out, "  Challenge String: %s\n", chal->data);
+		BIO_printf(out, "  Challenge String: %.*s\n", chal->length,
+		    chal->data);
 	i = OBJ_obj2nid(spki->sig_algor->algorithm);
 	BIO_printf(out, "  Signature Algorithm: %s",
 	    (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
diff --git a/lib/libcrypto/x509/x509_alt.c b/lib/libcrypto/x509/x509_alt.c
index 45aaec24c03..5b9f490bae1 100644
--- a/lib/libcrypto/x509/x509_alt.c
+++ b/lib/libcrypto/x509/x509_alt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_alt.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_alt.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -264,15 +264,18 @@ GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
 		break;
 
 	case GEN_EMAIL:
-		BIO_printf(out, "email:%s", gen->d.ia5->data);
+		BIO_printf(out, "email:%.*s", gen->d.ia5->length,
+		    gen->d.ia5->data);
 		break;
 
 	case GEN_DNS:
-		BIO_printf(out, "DNS:%s", gen->d.ia5->data);
+		BIO_printf(out, "DNS:%.*s", gen->d.ia5->length,
+		    gen->d.ia5->data);
 		break;
 
 	case GEN_URI:
-		BIO_printf(out, "URI:%s", gen->d.ia5->data);
+		BIO_printf(out, "URI:%.*s", gen->d.ia5->length,
+		    gen->d.ia5->data);
 		break;
 
 	case GEN_DIRNAME:
diff --git a/lib/libcrypto/x509/x509_cpols.c b/lib/libcrypto/x509/x509_cpols.c
index 4b6c13cfbeb..2ace607b23e 100644
--- a/lib/libcrypto/x509/x509_cpols.c
+++ b/lib/libcrypto/x509/x509_cpols.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_cpols.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_cpols.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -696,7 +696,8 @@ print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals, int indent)
 		qualinfo = sk_POLICYQUALINFO_value(quals, i);
 		switch (OBJ_obj2nid(qualinfo->pqualid)) {
 		case NID_id_qt_cps:
-			BIO_printf(out, "%*sCPS: %s\n", indent, "",
+			BIO_printf(out, "%*sCPS: %.*s\n", indent, "",
+			    qualinfo->d.cpsuri->length,
 			    qualinfo->d.cpsuri->data);
 			break;
 
@@ -724,8 +725,8 @@ print_notice(BIO *out, USERNOTICE *notice, int indent)
 	if (notice->noticeref) {
 		NOTICEREF *ref;
 		ref = notice->noticeref;
-		BIO_printf(out, "%*sOrganization: %s\n", indent, "",
-		    ref->organization->data);
+		BIO_printf(out, "%*sOrganization: %.*s\n", indent, "",
+		    ref->organization->length, ref->organization->data);
 		BIO_printf(out, "%*sNumber%s: ", indent, "",
 		    sk_ASN1_INTEGER_num(ref->noticenos) > 1 ? "s" : "");
 		for (i = 0; i < sk_ASN1_INTEGER_num(ref->noticenos); i++) {
@@ -741,8 +742,8 @@ print_notice(BIO *out, USERNOTICE *notice, int indent)
 		BIO_puts(out, "\n");
 	}
 	if (notice->exptext)
-		BIO_printf(out, "%*sExplicit Text: %s\n", indent, "",
-		    notice->exptext->data);
+		BIO_printf(out, "%*sExplicit Text: %.*s\n", indent, "",
+		    notice->exptext->length, notice->exptext->data);
 }
 
 void
diff --git a/lib/libcrypto/x509/x509_pci.c b/lib/libcrypto/x509/x509_pci.c
index 8997f0cec8e..b1d31dfb44b 100644
--- a/lib/libcrypto/x509/x509_pci.c
+++ b/lib/libcrypto/x509/x509_pci.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_pci.c,v 1.1 2020/06/04 15:19:31 jsing Exp $ */
+/* $OpenBSD: x509_pci.c,v 1.2 2021/08/24 15:23:03 tb Exp $ */
 /* Contributed to the OpenSSL Project 2004
  * by Richard Levitte (richard@levitte.org)
  */
@@ -77,7 +77,8 @@ i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci, BIO *out,
 	i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
 	BIO_puts(out, "\n");
 	if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
-		BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
+		BIO_printf(out, "%*sPolicy Text: %.*s\n", indent, "",
+		    pci->proxyPolicy->policy->length,
 		    pci->proxyPolicy->policy->data);
 	return 1;
 }