From: Simon Josefsson <jas@mocca.josefsson.org>
Date: Sun, 27 May 2007 15:23:21 +0000 (+0200)
Subject: (parse_pem_ca_mem): Handle reads beyond first certificate properly.
X-Git-Tag: gnutls_1_7_12~28
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9ea2c0d9577baee58d8157ffb1debb430d256bba;p=thirdparty%2Fgnutls.git

(parse_pem_ca_mem): Handle reads beyond first certificate properly.
Reported by Dennis Vshivkov <walrus@amur.ru> in
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=333050>.
---

diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 5172cfb033..d4b66ac500 100644
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -1153,21 +1153,21 @@ parse_pem_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
       /* now we move ptr after the pem header 
        */
       ptr++;
+      size--;
       /* find the next certificate (if any)
        */
 
-      size = input_cert_size - (ptr - input_cert);
-
       if (size > 0)
 	{
 	  char *ptr3;
 
 	  ptr3 = memmem (ptr, size, PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
 	  if (ptr3 == NULL)
-	    ptr = memmem (ptr, size,
+	    ptr3 = memmem (ptr, size,
 			  PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
 
 	  ptr = ptr3;
+	  size = input_cert_size - (ptr - input_cert);
 	}
       else
 	ptr = NULL;