mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix out-of-bounds write in sm2_crypt.c

Browse Source 
asn1_encode has two form length octets: short form(1 byte), long form(1+n byte).

CLA: Trivial

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7027)
This commit is contained in:
ymlbright 2018-08-22 11:22:11 +08:00 committed by Pauli
parent 7d38ca3f8b
commit 307a494e5b
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
crypto/sm2/sm2_crypt.c
View File

@ -91,11 +91,18 @@ int sm2_ciphertext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len,
{
const size_t field_size = ec_field_size(EC_KEY_get0_group(key));
const int md_size = EVP_MD_size(digest);
size_t sz;
if (field_size == 0 || md_size < 0)
return 0;
*ct_size = 12 + 2 * field_size + (size_t)md_size + msg_len;
/* Integer and string are simple type; set constructed = 0, means primitive and definite length encoding. */
sz = 2 * ASN1_object_size(0, field_size + 1, V_ASN1_INTEGER)
+ ASN1_object_size(0, md_size, V_ASN1_OCTET_STRING)
+ ASN1_object_size(0, msg_len, V_ASN1_OCTET_STRING);
/* Sequence is structured type; set constructed = 1, means constructed and definite length encoding. */
*ct_size = ASN1_object_size(1, sz, V_ASN1_SEQUENCE);
return 1;
}