From 033b4db86fa4d87b3d9ad991833e55c8bba58e61 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Fri, 13 Sep 2019 12:24:56 +0100 Subject: [PATCH] Fix X.509 SAN parsing Fixes #2838. See the issue description for more information. Signed-off-by: Andrzej Kurek --- library/x509.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/library/x509.c b/library/x509.c index 81e30e4ac728..fea1e9951872 100644 --- a/library/x509.c +++ b/library/x509.c @@ -1238,8 +1238,6 @@ int mbedtls_x509_get_subject_alt_name(unsigned char **p, { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; size_t len, tag_len; - mbedtls_asn1_buf *buf; - unsigned char tag; mbedtls_asn1_sequence *cur = subject_alt_name; /* Get main sequence tag */ @@ -1255,15 +1253,20 @@ int mbedtls_x509_get_subject_alt_name(unsigned char **p, while (*p < end) { mbedtls_x509_subject_alternative_name dummy_san_buf; + mbedtls_x509_buf tmp_san_buf; memset(&dummy_san_buf, 0, sizeof(dummy_san_buf)); - tag = **p; + tmp_san_buf.tag = **p; (*p)++; + if ((ret = mbedtls_asn1_get_len(p, end, &tag_len)) != 0) { return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret); } - if ((tag & MBEDTLS_ASN1_TAG_CLASS_MASK) != + tmp_san_buf.p = *p; + tmp_san_buf.len = tag_len; + + if ((tmp_san_buf.tag & MBEDTLS_ASN1_TAG_CLASS_MASK) != MBEDTLS_ASN1_CONTEXT_SPECIFIC) { return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG); @@ -1272,7 +1275,7 @@ int mbedtls_x509_get_subject_alt_name(unsigned char **p, /* * Check that the SAN is structured correctly. */ - ret = mbedtls_x509_parse_subject_alt_name(&(cur->buf), &dummy_san_buf); + ret = mbedtls_x509_parse_subject_alt_name(&tmp_san_buf, &dummy_san_buf); /* * In case the extension is malformed, return an error, * and clear the allocated sequences. @@ -1299,11 +1302,8 @@ int mbedtls_x509_get_subject_alt_name(unsigned char **p, cur = cur->next; } - buf = &(cur->buf); - buf->tag = tag; - buf->p = *p; - buf->len = tag_len; - *p += buf->len; + cur->buf = tmp_san_buf; + *p += tmp_san_buf.len; } /* Set final sequence entry's next pointer to NULL */