projects / oweals / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 005f489) | patch
Fix leak with ASN.1 combine.
authorDr. Stephen Henson <steve@openssl.org>
Tue, 10 Nov 2015 19:03:07 +0000 (19:03 +0000)
committerRichard Levitte <levitte@openssl.org>
Thu, 3 Dec 2015 12:45:13 +0000 (13:45 +0100)
commitb29ffa392e839d05171206523e84909146f7a77c
tree3b43dab619748502c1e0c0af22ab876ce489f938tree | snapshot
parent005f4893dc770d77eb07a098da32e0fca87f07b6commit | diff
Fix leak with ASN.1 combine.

When parsing a combined structure pass a flag to the decode routine
so on error a pointer to the parent structure is not zeroed as
this will leak any additional components in the parent.

This can leak memory in any application parsing PKCS#7 or CMS structures.

CVE-2015-3195.

Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using
libFuzzer.

PR#4131

Reviewed-by: Richard Levitte <levitte@openssl.org>
crypto/asn1/tasn_dec.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.