From: Bernd Edlinger <bernd.edlinger@hotmail.de>
Date: Mon, 1 Jul 2019 07:41:47 +0000 (+0200)
Subject: Check for V_ASN1_BOOLEAN/V_ASN1_NULL in X509_ATTRIBUTE_get0_data
X-Git-Tag: openssl-3.0.0-alpha1~1828
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=94f4d58a87eac9c6fe4cb46b998656bd6d6f03a5;p=oweals%2Fopenssl.git

Check for V_ASN1_BOOLEAN/V_ASN1_NULL in X509_ATTRIBUTE_get0_data

The member value.ptr is undefined for those ASN1 types.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9278)
---

diff --git a/crypto/x509/x509_att.c b/crypto/x509/x509_att.c
index f1cd9df23e..317a45a4fa 100644
--- a/crypto/x509/x509_att.c
+++ b/crypto/x509/x509_att.c
@@ -314,7 +314,9 @@ void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx,
     ttmp = X509_ATTRIBUTE_get0_type(attr, idx);
     if (!ttmp)
         return NULL;
-    if (atrtype != ASN1_TYPE_get(ttmp)) {
+    if (atrtype == V_ASN1_BOOLEAN
+            || atrtype == V_ASN1_NULL
+            || atrtype != ASN1_TYPE_get(ttmp)) {
         X509err(X509_F_X509_ATTRIBUTE_GET0_DATA, X509_R_WRONG_TYPE);
         return NULL;
     }