Introduce limits to prevent malicious keys being able to

[oweals/openssl.git] / crypto / asn1 / a_gentm.c

diff --git a/crypto/asn1/a_gentm.c b/crypto/asn1/a_gentm.c
index cd09f68b38f61baff588199f848b4088ab84d77c..def79062a57de3d0397eb0732a3fe2879eda7932 100644 (file)
--- a/crypto/asn1/a_gentm.c
+++ b/crypto/asn1/a_gentm.c
@@ -181,7 +181,7 @@ err:
        return(0);
        }
 
-int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, char *str)
+int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str)
        {
        ASN1_GENERALIZEDTIME t;
 
@@ -192,8 +192,9 @@ int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, char *str)
                {
                if (s != NULL)
                        {
-                       ASN1_STRING_set((ASN1_STRING *)s,
-                               (unsigned char *)str,t.length);
+                       if (!ASN1_STRING_set((ASN1_STRING *)s,
+                               (unsigned char *)str,t.length))
+                               return 0;
                        s->type=V_ASN1_GENERALIZEDTIME;
                        }
                return(1);
@@ -208,6 +209,7 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
        char *p;
        struct tm *ts;
        struct tm data;
+       size_t len = 20; 
 
        if (s == NULL)
                s=M_ASN1_GENERALIZEDTIME_new();
@@ -219,17 +221,22 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
                return(NULL);
 
        p=(char *)s->data;
-       if ((p == NULL) || (s->length < 16))
+       if ((p == NULL) || ((size_t)s->length < len))
                {
-               p=OPENSSL_malloc(20);
-               if (p == NULL) return(NULL);
+               p=OPENSSL_malloc(len);
+               if (p == NULL)
+                       {
+                       ASN1err(ASN1_F_ASN1_GENERALIZEDTIME_SET,
+                               ERR_R_MALLOC_FAILURE);
+                       return(NULL);
+                       }
                if (s->data != NULL)
                        OPENSSL_free(s->data);
                s->data=(unsigned char *)p;
                }
 
-       sprintf(p,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
-               ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
+       BIO_snprintf(p,len,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
+                    ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
        s->length=strlen(p);
        s->type=V_ASN1_GENERALIZEDTIME;
 #ifdef CHARSET_EBCDIC_not