From: Lev Stipakov Date: Tue, 22 Jan 2019 13:41:03 +0000 (+0200) Subject: crypto_openssl.c: fix heap-buffer-overflow found by AddressSanitizer X-Git-Tag: v2.5_beta1~348 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eb1fed3f3bb817332183672dd1ca665ece83d6a8;p=thirdparty%2Fopenvpn.git crypto_openssl.c: fix heap-buffer-overflow found by AddressSanitizer OpenSSL's version of crypto_pem_encode() uses PEM_write_bio() function to write PEM-encoded data to BIO object. That method doesn't add NUL termanator, unlike its mbedTLS counterpart mbedtls_pem_write_buffer(). The code which uses PEM data treats it as a string, so missing NUL terminator makes sanitizer to compain. Fix by adding a NUL terminator. Signed-off-by: Lev Stipakov Acked-by: Arne Schwabe Message-Id: <1548164463-13366-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18141.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index 9691ce056..c049e52db 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -400,8 +400,9 @@ crypto_pem_encode(const char *name, struct buffer *dst, BUF_MEM *bptr; BIO_get_mem_ptr(bio, &bptr); - *dst = alloc_buf_gc(bptr->length, gc); + *dst = alloc_buf_gc(bptr->length + 1, gc); ASSERT(buf_write(dst, bptr->data, bptr->length)); + buf_null_terminate(dst); ret = true; cleanup: