]> git.ipfire.org Git - thirdparty/openssl.git/commit
ossl-params: check length returned by strlen()
authorJames Muir <james@openssl.org>
Wed, 6 Dec 2023 21:49:11 +0000 (16:49 -0500)
committerTomas Mraz <tomas@openssl.org>
Tue, 12 Dec 2023 18:58:47 +0000 (19:58 +0100)
commit075ffab8b6fd8171295b748794af8757f72132f2
tree05ea7e11d38b73839cab696cc7f07eb2e5e4ce00
parent100ee76b1b32cf296346c1929604499463f2f01a
ossl-params: check length returned by strlen()

In param_build.c, the functions OSSL_PARAM_BLD_push_utf8_string() and
OSSL_PARAM_BLD_push_utf8_ptr() use strlen() to compute the length of
the string when bsize is zero.  However, the size_t returned by
strlen() might be too large (it is stored in an intermediate "int"),
so check for that.

There are analogous functions in params.c, but they do not use an
intermediate "int" to store the size_t returned by strlen().  So there
is some inconsistency between the implementations.

Credit to Viktor D and Tomas M for spotting these missing checks.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22967)

(cherry picked from commit d4d6694aa710c9970410a6836070daa6486a0ac0)
crypto/param_build.c