[openssl.org #2985] Infinite loop in openssl.cfg configuration file parser

[david.ll...@fsmail.net via RT]

Hi,

I accidentally entered a section header with double open square brackets in 
openssl.cfg and the ca program hangs on start up with 100% CPU (e.g. type "[[ 
ca ]").

The culprit seems to be line 322 of crypto/conf/conf_def.c:

again:
                        end=eat_alpha_numeric(conf, ss);
                        p=eat_ws(conf, end);
                        if (*p != ']')
                                {
                                if (*p != '\0')
                                        {
                                        ss=p;
                                        goto again;
                                        }
                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                        CONF_R_MISSING_CLOSE_SQUARE_BRACKET);
                                goto err;
                                }

The character is neither alpha numeric nor whitespace, so p = ss forever.  
Probably you should go for some variety of:

                                if (*p != '\0' && ss != p)

This will guarantee that the loop terminates.

Regards,

David L


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@openssl.org
Automated List Manager                           majord...@openssl.org