From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 21 Oct 2015 15:44:43 +0000 (-0400)
Subject: Check for len < 4 in dn_indicates_v3_cert
X-Git-Tag: tor-0.2.7.4-rc~5^2~2^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=35bf07b8d67d018f7740ca195cf8c7c86b1b4ef9;p=thirdparty%2Ftor.git

Check for len < 4 in dn_indicates_v3_cert

Without this check, we potentially look up to 3 characters before
the start of a malloc'd segment, which could provoke a crash under
certain (weird afaik) circumstances.

Fixes 17404; bugfix on 0.2.6.3-alpha.
---

diff --git a/changes/bug17404 b/changes/bug17404
new file mode 100644
index 0000000000..d524f6662d
--- /dev/null
+++ b/changes/bug17404
@@ -0,0 +1,6 @@
+  o Major bugfixes (security, correctness):
+    - Fix a programming error that could cause us to read 4 bytes before
+      the beginning of an openssl string. This could be used to provoke
+      a crash on systems with an unusual malloc implementation, or
+      systems with unsual hardening installed. Fixes bug 17404; bugfix
+      on 0.2.3.6-alpha.
diff --git a/src/common/tortls.c b/src/common/tortls.c
index 4222f6dbff..75ca47dbdb 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -2676,6 +2676,10 @@ dn_indicates_v3_cert(X509_NAME *name)
   len = ASN1_STRING_to_UTF8(&s, str);
   if (len < 0)
     return 0;
+  if (len < 4) {
+    OPENSSL_free(s);
+    return 0;
+  }
   r = fast_memneq(s + len - 4, ".net", 4);
   OPENSSL_free(s);
   return r;