From 20fc103f782bb0bcd41d211c6423187b02146b9d Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Tue, 2 Aug 2016 21:38:37 +0100 Subject: [PATCH] Limit status message sisze in ts_get_status_check Thanks to Shi Lei for reporting this issue. Reviewed-by: Rich Salz --- crypto/ts/ts_rsp_verify.c | 4 +++- include/openssl/ts.h | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/crypto/ts/ts_rsp_verify.c b/crypto/ts/ts_rsp_verify.c index 8ed973bdf8..99f664b431 100644 --- a/crypto/ts/ts_rsp_verify.c +++ b/crypto/ts/ts_rsp_verify.c @@ -451,12 +451,14 @@ static int ts_check_status_info(TS_RESP *response) static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) { int i; - unsigned int length = 0; + int length = 0; char *result = NULL; char *p; for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); + if (ASN1_STRING_length(current) > TS_MAX_STATUS_LENGTH - length - 1) + return NULL; length += ASN1_STRING_length(current); length += 1; /* separator character */ } diff --git a/include/openssl/ts.h b/include/openssl/ts.h index db8247482b..cd8f373c4c 100644 --- a/include/openssl/ts.h +++ b/include/openssl/ts.h @@ -346,6 +346,9 @@ int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, /* At most we accept usec precision. */ # define TS_MAX_CLOCK_PRECISION_DIGITS 6 +/* Maximum status message length */ +# define TS_MAX_STATUS_LENGTH (1024 * 1024) + /* No flags are set by default. */ void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); -- 2.25.1