diff options
Diffstat (limited to 'debian/patches/ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch')
| -rw-r--r-- | debian/patches/ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/debian/patches/ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch b/debian/patches/ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch new file mode 100644 index 0000000..321a57a --- /dev/null +++ b/debian/patches/ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch @@ -0,0 +1,48 @@ +From 8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793 Mon Sep 17 00:00:00 2001 +From: Howard Chu <hyc@openldap.org> +Date: Sun, 13 Dec 2020 21:48:45 +0000 +Subject: [PATCH] ITS#9423 ldap_X509dn2bv: check for invalid BER after RDN + count + +--- + libraries/libldap/tls2.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index ca5a44ab0c..e0c82fa9f8 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -1254,6 +1254,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func, + } + } + ++ /* Rewind and prepare to extract */ ++ ber_rewind( ber ); ++ tag = ber_first_element( ber, &len, &dn_end ); ++ if ( tag == LBER_DEFAULT ) ++ return LDAP_DECODING_ERROR; ++ + /* Allocate the DN/RDN/AVA stuff as a single block */ + dnsize = sizeof(LDAPRDN) * (nrdns+1); + dnsize += sizeof(LDAPAVA *) * (navas+nrdns); +@@ -1265,16 +1271,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func, + } else { + newDN = (LDAPDN)(char *)ptrs; + } +- ++ + newDN[nrdns] = NULL; + newRDN = (LDAPRDN)(newDN + nrdns+1); + newAVA = (LDAPAVA *)(newRDN + navas + nrdns); + baseAVA = newAVA; + +- /* Rewind and start extracting */ +- ber_rewind( ber ); +- +- tag = ber_first_element( ber, &len, &dn_end ); + for ( i = nrdns - 1; i >= 0; i-- ) { + newDN[i] = newRDN; + +-- +2.20.1 + |