From: Matt Caswell <matt@openssl.org>
Date: Thu, 19 Aug 2021 11:23:38 +0000 (+0100)
Subject: Fix NETSCAPE_SPKI_print function to not assume NUL terminated strings
X-Git-Tag: openssl-3.0.0~86
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7c038a6bcd98d4bbfd2c2892a87a1138d2f7c5f3;p=thirdparty%2Fopenssl.git

Fix NETSCAPE_SPKI_print function to not assume NUL terminated strings

ASN.1 strings may not be NUL terminated. Don't assume they are.

CVE-2021-3712

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David Benjamin <davidben@google.com>
---

diff --git a/crypto/asn1/t_spki.c b/crypto/asn1/t_spki.c
index b634808c433..3d85e08686f 100644
--- a/crypto/asn1/t_spki.c
+++ b/crypto/asn1/t_spki.c
@@ -38,7 +38,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
     }
     chal = spki->spkac->challenge;
     if (chal->length)
-        BIO_printf(out, "  Challenge String: %s\n", chal->data);
+        BIO_printf(out, "  Challenge String: %.*s\n", chal->length, chal->data);
     i = OBJ_obj2nid(spki->sig_algor.algorithm);
     BIO_printf(out, "  Signature Algorithm: %s",
                (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));