Corrected buffer overrun in crt_list_import. Reported and patch by Jonathan Manktelow.

diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 8ee8105167e9acc3ae30d784ffbbb2a416af24c3..8be70e1053e09a82fe5476ca57839a0ceabdab64 100644 (file)
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -2826,7 +2826,7 @@ gnutls_x509_crt_list_import (gnutls_x509_crt_t * certs,
            }
 
          tmp.data = (void *) ptr;
-         tmp.size = size;
+         tmp.size = data->size - (ptr - (char *) data->data);
 
          ret =
            gnutls_x509_crt_import (certs[count], &tmp, GNUTLS_X509_FMT_PEM);