From 3b421ebc64c7b52f1b9feb3812bdc7781c784332 Mon Sep 17 00:00:00 2001 From: Pauli Date: Thu, 27 Oct 2022 10:21:41 +1100 Subject: [PATCH] Fix CVE-2022-3602 in punycode decoder. An off by one error in the punycode decoder allowed for a single unsigned int overwrite of a buffer which could cause a crash and possible code execution. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (cherry picked from commit fe3b639dc19b325846f4f6801f2f4604f56e3de3) --- crypto/punycode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/punycode.c b/crypto/punycode.c index f6d7ff7960..f0796163e3 100644 --- a/crypto/punycode.c +++ b/crypto/punycode.c @@ -181,7 +181,7 @@ int ossl_punycode_decode(const char *pEncoded, const size_t enc_len, n = n + i / (written_out + 1); i %= (written_out + 1); - if (written_out > max_out) + if (written_out >= max_out) return 0; memmove(pDecoded + i + 1, pDecoded + i,