From 7552832ed466b13ee9859ca7420f3577d0570443 Mon Sep 17 00:00:00 2001 From: Luigi Coniglio Date: Thu, 3 Oct 2019 19:57:10 +0200 Subject: [PATCH] Fixes #507 in LTC - vulnerability in der_decode_utf8_string() Fix a vulnerability in der_decode_utf8_string as specified here: https://github.com/libtom/libtomcrypt/issues/507 Patch manually picked from: https://github.com/libtom/libtomcrypt/commit/25c26a3b7a9ad8192ccc923e15cf62bf0108ef94 Signed-off-by: Luigi Coniglio [Joakim Bech: Extended commit message] Signed-off-by: Joakim Bech Acked-by: Joakim Bech Tested-by: Joakim Bech (QEMU v7) Acked-by: Jerome Forissier --- .../libtomcrypt/src/pk/asn1/der/utf8/der_decode_utf8_string.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/lib/libtomcrypt/src/pk/asn1/der/utf8/der_decode_utf8_string.c b/core/lib/libtomcrypt/src/pk/asn1/der/utf8/der_decode_utf8_string.c index a97f57b0624..8c42cd4a84f 100644 --- a/core/lib/libtomcrypt/src/pk/asn1/der/utf8/der_decode_utf8_string.c +++ b/core/lib/libtomcrypt/src/pk/asn1/der/utf8/der_decode_utf8_string.c @@ -66,7 +66,7 @@ int der_decode_utf8_string(const unsigned char *in, unsigned long inlen, /* count number of bytes */ for (z = 0; (tmp & 0x80) && (z <= 4); z++, tmp = (tmp << 1) & 0xFF); - if (z > 4 || (x + (z - 1) > inlen)) { + if (z == 1 || z > 4 || (x + (z - 1) > inlen)) { return CRYPT_INVALID_PACKET; }