Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cast to at least 32 bit unsigned type when shifting left 24 places #11857

Closed
wants to merge 4 commits into from
Closed

Cast to at least 32 bit unsigned type when shifting left 24 places #11857

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
32cf890
Cast the unsigned char to unsigned int before shifting left
t8m May 19, 2020
a7be9c2
Avoid potential overflow to the sign bit when shifting left 24 places
t8m May 19, 2020
0b32df1
t1_trce: Fix remaining places where the 24 bit shift overflow happens
t8m May 19, 2020
85b7559
fixup! t1_trce: Fix remaining places where the 24 bit shift overflow …
t8m May 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion crypto/bn/bn_mpi.c
View file
Open in desktop
Expand Up @@ -45,7 +45,7 @@ BIGNUM *BN_mpi2bn(const unsigned char *d, int n, BIGNUM *ain)
int neg = 0;
BIGNUM *a = NULL;

if (n < 4) {
if (n < 4 || (d[0] & 0x80) != 0) {
BNerr(BN_F_BN_MPI2BN, BN_R_INVALID_LENGTH);
return NULL;
}
bernd-edlinger marked this conversation as resolved.
Show resolved Hide resolved
Expand Down
8 changes: 4 additions & 4 deletions crypto/pem/pvkfmt.c
View file
Open in desktop
Expand Up @@ -36,10 +36,10 @@ static unsigned int read_ledword(const unsigned char **in)
{
const unsigned char *p = *in;
unsigned int ret;
ret = *p++;
ret |= (*p++ << 8);
ret |= (*p++ << 16);
ret |= (*p++ << 24);
ret = (unsigned int)*p++;
ret |= (unsigned int)*p++ << 8;
ret |= (unsigned int)*p++ << 16;
ret |= (unsigned int)*p++ << 24;
*in = p;
return ret;
}
Expand Down
21 changes: 16 additions & 5 deletions ssl/t1_trce.c
View file
Open in desktop
Expand Up @@ -665,7 +665,10 @@ static int ssl_print_random(BIO *bio, int indent,

if (*pmsglen < 32)
return 0;
tm = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
tm = ((unsigned int)p[0] << 24)
| ((unsigned int)p[1] << 16)
| ((unsigned int)p[2] << 8)
| (unsigned int)p[3];
p += 4;
BIO_indent(bio, indent, 80);
BIO_puts(bio, "Random:\n");
Expand Down Expand Up @@ -870,8 +873,10 @@ static int ssl_print_extension(BIO *bio, int indent, int server,
break;
if (extlen != 4)
return 0;
max_early_data = (ext[0] << 24) | (ext[1] << 16) | (ext[2] << 8)
| ext[3];
max_early_data = ((unsigned int)ext[0] << 24)
| ((unsigned int)ext[1] << 16)
| ((unsigned int)ext[2] << 8)
| (unsigned int)ext[3];
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Likewise here, no test coverage for the previously undefined behavior.

BIO_indent(bio, indent + 2, 80);
BIO_printf(bio, "max_early_data=%u\n", max_early_data);
break;
Expand Down Expand Up @@ -1366,7 +1371,10 @@ static int ssl_print_ticket(BIO *bio, int indent, const SSL *ssl,
}
if (msglen < 4)
return 0;
tick_life = (msg[0] << 24) | (msg[1] << 16) | (msg[2] << 8) | msg[3];
tick_life = ((unsigned int)msg[0] << 24)
| ((unsigned int)msg[1] << 16)
| ((unsigned int)msg[2] << 8)
| (unsigned int)msg[3];
msglen -= 4;
msg += 4;
BIO_indent(bio, indent + 2, 80);
Expand All @@ -1377,7 +1385,10 @@ static int ssl_print_ticket(BIO *bio, int indent, const SSL *ssl,
if (msglen < 4)
return 0;
ticket_age_add =
(msg[0] << 24) | (msg[1] << 16) | (msg[2] << 8) | msg[3];
((unsigned int)msg[0] << 24)
| ((unsigned int)msg[1] << 16)
| ((unsigned int)msg[2] << 8)
| (unsigned int)msg[3];
msglen -= 4;
msg += 4;
BIO_indent(bio, indent + 2, 80);
Expand Down