]> git.ipfire.org Git - people/ms/strongswan.git/commit
cert-cache: Prevent crash due to integer overflow/sign change
authorTobias Brunner <tobias@strongswan.org>
Tue, 28 Sep 2021 17:38:22 +0000 (19:38 +0200)
committerTobias Brunner <tobias@strongswan.org>
Thu, 14 Oct 2021 16:59:07 +0000 (18:59 +0200)
commitdceed8e099c8f9d5606fa7e5a0742fb5e023103b
tree890b0a09feeb227cbc484f56f31e35d720620762
parent234302a108b490635fb961ebd1404340c46cefc3
cert-cache: Prevent crash due to integer overflow/sign change

random() allocates values in the range [0, RAND_MAX], with RAND_MAX usually
equaling INT_MAX = 2^31-1.  Previously, values between 0 and 31 were added
directly to that offset before applying`% CACHE_SIZE` to get an index into
the cache array.  If the random value was very high, this resulted in an
integer overflow and a negative index value and, therefore, an out-of-bounds
access of the array and in turn dereferencing invalid pointers when trying
to acquire the read lock.  This most likely results in a segmentation fault.

Fixes: 764e8b2211ce ("reimplemented certificate cache")
Fixes: CVE-2021-41991
src/libstrongswan/credentials/sets/cert_cache.c