]> git.ipfire.org Git - thirdparty/openssl.git/commit
Harden property put_str() helper corner case
authorViktor Dukhovni <openssl-users@dukhovni.org>
Sat, 20 Sep 2025 04:02:52 +0000 (14:02 +1000)
committerTomas Mraz <tomas@openssl.org>
Tue, 23 Sep 2025 09:57:35 +0000 (11:57 +0200)
commit3aa8a0c635d5e45d0bb1d8f4acebae5deda236af
tree92b9d82e3e303795a83f96ba1a067ba11bbf2f2f
parentd78fc81d8fb7d4d0ab4a5d434be74b5e858f1180
Harden property put_str() helper corner case

The put_str() helper of the internal ossl_property_list_to_string()
function failed to correctly check the remaining buffer length in a
corner case in which a property name or string value needs quoting,
and exactly one byte of unused space remained in the output buffer.

The only potentially affected calling code is conditionally compiled
(disabled by default) provider "QUERY" tracing that is executed only
when also requested at runtime.  An initial fragment of the property
list encoding would need to use up exactly 511 bytes, leaving just 1
byte for the next string which requires quoting.  Bug reported by

    Aniruddhan Murali (@ashamedbit)
    Noble Saji Mathews (@NobleMathews)

both from the University of Waterloo.

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28624)

(cherry picked from commit c6e44fa347aabfc279ec2e50a02fd764c2e8e241)
crypto/property/property_parse.c