diff options
| author | Filippo Valsorda <filippo@golang.org> | 2020-01-22 16:59:53 -0500 |
|---|---|---|
| committer | Katie Hockman <katie@golang.org> | 2020-01-28 17:40:31 +0000 |
| commit | 69ecbb4d6d5dab05e49161c6e77ea40a030884e1 (patch) | |
| tree | 844c120ad80e0145967f4245a4c5bb3d56b9008b /cryptobyte/string.go | |
| parent | 530e935923ad688be97c15eeb8e5ee42ebf2b54a (diff) | |
| download | go-x-crypto-69ecbb4d6d5dab05e49161c6e77ea40a030884e1.tar.xz | |
cryptobyte: fix panic due to malformed ASN.1 inputs on 32-bit archs
When int is 32 bits wide (on 32-bit architectures like 386 and arm), an
overflow could occur, causing a panic, due to malformed ASN.1 being
passed to any of the ASN1 methods of String.
Tested on linux/386 and darwin/amd64.
This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof
test vectors.
Change-Id: I8c9696a8bfad1b40ec877cd740dba3467d66ab54
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/645211
Reviewed-by: Katie Hockman <katiehockman@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/216677
Run-TryBot: Katie Hockman <katie@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Diffstat (limited to 'cryptobyte/string.go')
| -rw-r--r-- | cryptobyte/string.go | 7 |
1 files changed, 1 insertions, 6 deletions
diff --git a/cryptobyte/string.go b/cryptobyte/string.go index 39bf98a..589d297 100644 --- a/cryptobyte/string.go +++ b/cryptobyte/string.go @@ -24,7 +24,7 @@ type String []byte // read advances a String by n bytes and returns them. If less than n bytes // remain, it returns nil. func (s *String) read(n int) []byte { - if len(*s) < n { + if len(*s) < n || n < 0 { return nil } v := (*s)[:n] @@ -105,11 +105,6 @@ func (s *String) readLengthPrefixed(lenLen int, outChild *String) bool { length = length << 8 length = length | uint32(b) } - if int(length) < 0 { - // This currently cannot overflow because we read uint24 at most, but check - // anyway in case that changes in the future. - return false - } v := s.read(int(length)) if v == nil { return false |