From: Joe Orton <jorton@apache.org>
Date: Mon, 6 Jul 2026 08:15:14 +0000 (+0000)
Subject: * modules/md/md_crypt.c (md_cert_get_ari_cert_id):
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7612f2b72f6529f949d0a099df641f075542f9a3;p=thirdparty%2Fapache%2Fhttpd.git

* modules/md/md_crypt.c (md_cert_get_ari_cert_id):
  Don't used fixed buffer size for serial number,
  fail if ASN.1->BIGNUM conversion fails.

Github: closes #680


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935926 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/md/md_crypt.c b/modules/md/md_crypt.c
index eef1268353..a90eb0fc9b 100644
--- a/modules/md/md_crypt.c
+++ b/modules/md/md_crypt.c
@@ -2226,7 +2226,7 @@ apr_status_t md_cert_get_ari_cert_id(const char **pari_cert_id,
     const ASN1_INTEGER *serial;
     BIGNUM *bn;
     int i = -1, sder_len;
-    unsigned char *ucp, sbuf[256];
+    unsigned char *ucp, *sbuf;
 
     *pari_cert_id = NULL;
     s_aki = X509_get_ext_d2i(cert->x509, NID_authority_key_identifier, &i, NULL);
@@ -2253,6 +2253,10 @@ apr_status_t md_cert_get_ari_cert_id(const char **pari_cert_id,
     }
     memset(&ser_buf, 0, sizeof(ser_buf));
     bn = ASN1_INTEGER_to_BN(serial, NULL);
+    if (!bn) {
+        return APR_EINVAL;
+    }
+    sbuf = apr_pcalloc(p, BN_num_bytes(bn));
     sder_len = BN_bn2bin(bn, sbuf);
     BN_free(bn);
     if (sder_len < 1)