projects / oweals / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7a43389) | patch
Harden ASN.1 BIO handling of large amounts of data.
authorDr. Stephen Henson <steve@openssl.org>
Mon, 11 Apr 2016 12:57:20 +0000 (13:57 +0100)
committerDr. Stephen Henson <steve@openssl.org>
Fri, 22 Apr 2016 23:28:06 +0000 (00:28 +0100)
commit3d411057a5e28530fffc40b257698f453c89aa87
tree9c58fd3f78ad59764961ee9d14b3a6c7008ee002tree | snapshot
parent7a433893adbe7eab3c41581175493d9e5326ba3fcommit | diff
Harden ASN.1 BIO handling of large amounts of data.

If the ASN.1 BIO is presented with a large length field read it in
chunks of increasing size checking for EOF on each read. This prevents
small files allocating excessive amounts of data.

CVE-2016-2109

Thanks to Brian Carpenter for reporting this issue.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(cherry picked from commit c62981390d6cf9e3d612c489b8b77c2913b25807)
crypto/asn1/a_d2i_fp.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.