mmo-ref/dep-libtomcrypt
1
0
Fork 0
mirror of https://github.com/libtom/libtomcrypt synced 2026-08-25 20:26:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

hardening pkcs8_get_children against uninitialized output pointers

Browse source
This commit is contained in:
Karel Miko 2026-07-28 16:33:09 +02:00
parent 5c7757d0a5
commit 209df8ae1a
8 changed files with 19 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/misc/pem/pem_pkcs.c
View file

@ -73,7 +73,7 @@ static int s_import_pkcs8(unsigned char *asn1_cert, unsigned long asn1_len, ltc_
{
int err;
enum ltc_oid_id oid_id;
ltc_asn1_list *alg_id, *priv_key;
ltc_asn1_list *alg_id = NULL, *priv_key = NULL;
ltc_asn1_list *p8_asn1 = NULL;
if ((err = pkcs8_decode_flexi(asn1_cert, asn1_len, pw_ctx, &p8_asn1)) != CRYPT_OK) {
goto cleanup;

13
src/pk/asn1/pkcs8/pkcs8_get.c
View file

@ -14,11 +14,16 @@ int pkcs8_get_children(const ltc_asn1_list *decoded_list, enum ltc_oid_id *pka,
int err;
unsigned long n;
der_flexi_check flexi_should[4];
ltc_asn1_list *seq_l, *version;
ltc_asn1_list *seq_l = NULL, *priv_l = NULL, *version = NULL;
LTC_ARGCHK(ltc_mp.name != NULL);
if (alg_id == NULL) alg_id = &seq_l;
if (priv_key == NULL) priv_key = &priv_l;
/* der_flexi_sequence_cmp() writes only matched outputs, so unmatched ones stay NULL */
*alg_id = NULL;
*priv_key = NULL;
/* Setup for basic structure */
n=0;
@ -35,6 +40,9 @@ int pkcs8_get_children(const ltc_asn1_list *decoded_list, enum ltc_oid_id *pka,
* we get an 'input too long' error but the rest is already decoded and can be
* handled the same as for version 0
*/
if (version == NULL) {
return CRYPT_INVALID_PACKET;
}
if (ltc_mp_cmp_d(version->data, 0) != LTC_MP_EQ && ltc_mp_cmp_d(version->data, 1) != LTC_MP_EQ) {
return CRYPT_INVALID_PACKET;
}
@ -42,6 +50,9 @@ int pkcs8_get_children(const ltc_asn1_list *decoded_list, enum ltc_oid_id *pka,
default:
return err;
}
if ((*alg_id == NULL) || ((*alg_id)->child == NULL) || (*priv_key == NULL)) {
return CRYPT_INVALID_PACKET;
}
return pk_get_oid_from_asn1((*alg_id)->child, pka);
}

2
src/pk/dh/dh_import_pkcs8.c
View file

@ -61,7 +61,7 @@ int dh_import_pkcs8(const unsigned char *in, unsigned long inlen,
{
int err;
ltc_asn1_list *l = NULL;
ltc_asn1_list *alg_id, *priv_key;
ltc_asn1_list *alg_id = NULL, *priv_key = NULL;
enum ltc_oid_id pka;
LTC_ARGCHK(in != NULL);

2
src/pk/dsa/dsa_import_pkcs8.c
View file

@ -62,7 +62,7 @@ int dsa_import_pkcs8(const unsigned char *in, unsigned long inlen,
{
int err;
ltc_asn1_list *l = NULL;
ltc_asn1_list *alg_id, *priv_key;
ltc_asn1_list *alg_id = NULL, *priv_key = NULL;
enum ltc_oid_id pka;
LTC_ARGCHK(in != NULL);

2
src/pk/ec25519/ec25519_import_pkcs8.c
View file

@ -60,7 +60,7 @@ int ec25519_import_pkcs8(const unsigned char *in, unsigned long inlen,
{
int err;
ltc_asn1_list *l = NULL;
ltc_asn1_list *alg_id, *priv_key;
ltc_asn1_list *alg_id = NULL, *priv_key = NULL;
enum ltc_oid_id pka;
LTC_ARGCHK(in != NULL);

2
src/pk/ec448/ec448_import_pkcs8.c
View file

@ -60,7 +60,7 @@ int ec448_import_pkcs8(const unsigned char *in, unsigned long inlen,
{
int err;
ltc_asn1_list *l = NULL;
ltc_asn1_list *alg_id, *priv_key;
ltc_asn1_list *alg_id = NULL, *priv_key = NULL;
enum ltc_oid_id pka;
LTC_ARGCHK(in != NULL);

2
src/pk/ecc/ecc_import_pkcs8.c
View file

@ -140,7 +140,7 @@ int ecc_import_pkcs8(const unsigned char *in, unsigned long inlen,
{
int err;
ltc_asn1_list *l = NULL;
ltc_asn1_list *alg_id, *priv_key;
ltc_asn1_list *alg_id = NULL, *priv_key = NULL;
enum ltc_oid_id pka;
LTC_ARGCHK(key != NULL);

2
src/pk/rsa/rsa_import_pkcs8.c
View file

@ -44,7 +44,7 @@ int rsa_import_pkcs8(const unsigned char *in, unsigned long inlen,
{
int err;
ltc_asn1_list *l = NULL;
ltc_asn1_list *alg_id, *priv_key;
ltc_asn1_list *alg_id = NULL, *priv_key = NULL;
enum ltc_oid_id pka;
LTC_ARGCHK(in != NULL);