Patrick Williams | f1e5d69 | 2016-03-30 15:21:19 -0500 | [diff] [blame] | 1 | From cc598f321fbac9c04da5766243ed55d55948637d Mon Sep 17 00:00:00 2001 |
| 2 | From: "Dr. Stephen Henson" <steve@openssl.org> |
| 3 | Date: Tue, 10 Nov 2015 19:03:07 +0000 |
| 4 | Subject: [PATCH] Fix leak with ASN.1 combine. |
| 5 | |
| 6 | When parsing a combined structure pass a flag to the decode routine |
| 7 | so on error a pointer to the parent structure is not zeroed as |
| 8 | this will leak any additional components in the parent. |
| 9 | |
| 10 | This can leak memory in any application parsing PKCS#7 or CMS structures. |
| 11 | |
| 12 | CVE-2015-3195. |
| 13 | |
| 14 | Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using |
| 15 | libFuzzer. |
| 16 | |
| 17 | PR#4131 |
| 18 | |
| 19 | Reviewed-by: Richard Levitte <levitte@openssl.org> |
| 20 | |
| 21 | Upstream-Status: Backport |
| 22 | |
| 23 | This patch was imported from |
| 24 | https://git.openssl.org/?p=openssl.git;a=commit;h=cc598f321fbac9c04da5766243ed55d55948637d |
| 25 | |
| 26 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 27 | |
| 28 | --- |
| 29 | crypto/asn1/tasn_dec.c | 7 +++++-- |
| 30 | 1 file changed, 5 insertions(+), 2 deletions(-) |
| 31 | |
| 32 | diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c |
| 33 | index febf605..9256049 100644 |
| 34 | --- a/crypto/asn1/tasn_dec.c |
| 35 | +++ b/crypto/asn1/tasn_dec.c |
| 36 | @@ -180,6 +180,8 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, |
| 37 | int otag; |
| 38 | int ret = 0; |
| 39 | ASN1_VALUE **pchptr, *ptmpval; |
| 40 | + int combine = aclass & ASN1_TFLG_COMBINE; |
| 41 | + aclass &= ~ASN1_TFLG_COMBINE; |
| 42 | if (!pval) |
| 43 | return 0; |
| 44 | if (aux && aux->asn1_cb) |
| 45 | @@ -500,7 +502,8 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, |
| 46 | auxerr: |
| 47 | ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_AUX_ERROR); |
| 48 | err: |
| 49 | - ASN1_item_ex_free(pval, it); |
| 50 | + if (combine == 0) |
| 51 | + ASN1_item_ex_free(pval, it); |
| 52 | if (errtt) |
| 53 | ERR_add_error_data(4, "Field=", errtt->field_name, |
| 54 | ", Type=", it->sname); |
| 55 | @@ -689,7 +692,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val, |
| 56 | } else { |
| 57 | /* Nothing special */ |
| 58 | ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), |
| 59 | - -1, 0, opt, ctx); |
| 60 | + -1, tt->flags & ASN1_TFLG_COMBINE, opt, ctx); |
| 61 | if (!ret) { |
| 62 | ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR); |
| 63 | goto err; |
| 64 | -- |
| 65 | 2.3.5 |
| 66 | |