Merge r179781 from trunk:

* modules/ssl/ssl_engine_kernel.c (ssl_callback_SSLVerify_CRL): Fix
off-by-one.

PR: 35081
Submitted by: Marc Stern <mstern csc.com>
Reviewed by: jorton, trawick, pquerna

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@189562 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 384dbbe6dd875302bd438439f74f982d172addec..d6b1de84ede1bcad5cb11f5e13d23588afc64b53 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,10 @@
 Changes with Apache 2.0.55
 
+  *) SECURITY: CAN-2005-1268 (cve.mitre.org)
+     mod_ssl: Fix off-by-one overflow whilst printing CRL information
+     at "LogLevel debug" which could be triggered if configured 
+     to use a "malicious" CRL.  PR 35081.  [Marc Stern <mstern csc.com>]
+
   *) mod_userdir: Fix possible memory corruption issue.  PR 34588.
      [David Leonard <dleonard vintela.com>]
 

diff --git a/STATUS b/STATUS
index c063539788542eac0d18ad93a25662e8a0ce1eed..c49607f7fcf9b97cf136f846b7ea3a93df2c1c31 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -268,11 +268,6 @@ PATCHES TO BACKPORT FROM TRUNK:
         http://svn.apache.org/viewcvs?rev=179622&view=rev
         +1: trawick
 
-     *) mod_ssl: Fix off-by-one, CVE CAN-2005-1268.
-        PR: 35081
-        http://svn.apache.org/viewcvs?rev=179781&view=rev
-        +1: jorton, trawick, pquerna
-
      *) mod_cache: Fix handling of 'Vary: *". PR 16125.
         Trunk: r180341
         2.0.x Patch: http://issues.apache.org/bugzilla/attachment.cgi?id=15297

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 48da7405049b864db1039f216c70a4c03db13eef..268079bd5c73b1091b05146ccb410fedec43accf 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -1398,7 +1398,7 @@ int ssl_callback_SSLVerify_CRL(int ok, X509_STORE_CTX *ctx, conn_rec *c)
             BIO_printf(bio, ", nextUpdate: ");
             ASN1_UTCTIME_print(bio, X509_CRL_get_nextUpdate(crl));
 
-            n = BIO_read(bio, buff, sizeof(buff));
+            n = BIO_read(bio, buff, sizeof(buff) - 1);
             buff[n] = '\0';
 
             BIO_free(bio);