Hello all
"Unchecked return from gmtime in ASN1 time set routine can cause core dump on
Windows"
I found this problem when debugging 'nmake test' for Net::SSLeay.
openssl is called:
openssl.exe req
-config examples/req.conf
-x509
-days 36500
-new
-keyout examples/key.pem
Those hundred years in the -days argument seem to bee too much for Windows. The
time value t in the
ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
function (in crypto/asn1/a_utctm.c:192) runs over into the negative
(0xf954fcaf).
The subsequent call to
ts=gmtime(&t);
returns a NULL pointer.
This pointer doesn't get checked and the following call to
sprintf(p,"%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
dumps core. (Well, the system croaks up an 'access violation')
I recommend checking the return from gmtime and using an error exit on NULL.
Stack trace:
ASN1_UTCTIME_set(asn1_string_st * 0x008b0d70, long 0xf954fcaf) line 260 + 3
bytes
X509_time_adj(asn1_string_st * 0x008b0d70, long 0xbbf81e00, long * 0x00000000)
line 657 + 22 bytes
X509_gmtime_adj(asn1_string_st * 0x008b0d70, long 0xbbf81e00) line 645 + 15
bytes
req_main(int 0x00000000, char * * 0x00892a88) line 725 + 30 bytes
do_cmd(lhash_st * 0x008adbf8, int 0x00000009, char * * 0x00892a64) line 236 +
14 bytes
main(int 0x00000009, char * * 0x00892a64) line 155 + 20 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e97d08()
My system:
Windows 2000 SP2 on Intel Pentium
Compiler Visual C++ V6 SP4
openssl version -a :
OpenSSL 0.9.6g 9 Aug 2002
built on: Wed Aug 14 13:54:34 2002
platform: VC-WIN32
options: bn(64,32) md2(int) rc4(idx,int) des(idx,cisc,4,long) idea(int)
blowfish(idx)
compiler: cl /W3 /WX /Zi /Yd /Od /nologo -DWIN32 -D_DEBUG -DL_ENDIAN
-DWIN32_LEAN_AND_MEAN -DDEBUG -DDSO_WIN32 /MTd -DBN_ASM -DMD5_ASM -DSHA1_ASM
-DRMD160_ASM /Fdout32dll
Thanks for your work!
Marcel Bucher
[EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
