[[EMAIL PROTECTED] - Thu Apr 25 16:24:12 2002]:
> > There is an input sanity check in asn1_lib.c that is #if'd out for > some reason. In its absence, a corrupt certificate read by d2i_X509() > can at least crash the process. Additionally, the sanity checks both > there and in a_bytes.c do not take into account a possibility of > negative length and of pointer wrap-around, with similar results. > > Code to demonstrate the bug (just run it for a few hours) and a diff > are attached. > > Was the #if'ing out of the test intentional, and am I risking anything > by enabling it? Right now I am patching openssl-engine-0.9.6c > privately, but of course I'd be much happier to know I'd be able to > just use plain vanilla 0.9.6d. > The original reason for this was, I believe, to handle broken ASN1 encodings. There are a few cases where the length parameters of certain structures are not correct, for example in SEQUENCE or SET tags. Unfortunately due to the way the old ASN1 code worked you couldn't set an upper length bound for the surrounding buffer. It is possible, I suppose, that uncommenting out that section might occasionally result in a certificate or other ASN1 structure being rejected that would be otherwise be tolerated. OpenSSL 0.9.7 should handle this better, it still retains the #ifdef'ed out section but it now makes an additional sanity check in asn1_check_tlen in tasn_dec.c . Steve. ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
