fix certificate blob parsing vulnerability by using blob_parse_untrusted
authorPetr Štetiar <ynezz@true.cz>
Mon, 16 Dec 2019 13:58:50 +0000 (14:58 +0100)
committerPetr Štetiar <ynezz@true.cz>
Mon, 16 Dec 2019 19:52:58 +0000 (20:52 +0100)
commit14a279411cff06f9b1363711df4ec3b5db73f042
tree2bb5f3bb7eb98683336661773856e92e1abab6e1
parent19a7225ac0188f3b3945b5608e02fc0101127bbd
fix certificate blob parsing vulnerability by using blob_parse_untrusted

blob_parse expects blobs from trusted inputs, but in this case it can be
supplied with possibly malicious certificates from untrusted inputs as
well, so in order to prevent such conditions, switch to
blob_parse_untrusted which should hopefully handle such inputs
appropriately.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
ucert.c