From: Jake Cooke <jcooke2297@outlook.com>
Date: Tue, 18 May 2021 08:50:54 +0000 (+0930)
Subject: Add bounds checking to length returned by wcslen in wide_to_asc conversion to resolve... 
X-Git-Tag: openssl-3.0.0-alpha17~37
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cad4f3facc2ff5dce97b08b9ab8718783358b30c;p=thirdparty%2Fopenssl.git

Add bounds checking to length returned by wcslen in wide_to_asc conversion to resolve integer overflow flaw

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15316)
---

diff --git a/engines/e_capi.c b/engines/e_capi.c
index dd66518d3f5..2ea3cd20595 100644
--- a/engines/e_capi.c
+++ b/engines/e_capi.c
@@ -1120,10 +1120,19 @@ static char *wide_to_asc(LPCWSTR wstr)
 {
     char *str;
     int len_0, sz;
+    size_t len_1;
 
     if (!wstr)
         return NULL;
-    len_0 = (int)wcslen(wstr) + 1; /* WideCharToMultiByte expects int */
+
+    len_1 = wcslen(wstr) + 1;
+
+    if (len_1 > INT_MAX) {
+	    CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_FUNCTION_NOT_SUPPORTED);
+	    return NULL;
+    }
+
+    len_0 = (int)len_1; /* WideCharToMultiByte expects int */
     sz = WideCharToMultiByte(CP_ACP, 0, wstr, len_0, NULL, 0, NULL, NULL);
     if (!sz) {
         CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);