mirror of https://github.com/wolfSSL/wolfssh.git
Fix integer overflow in ParseRFC6187 name length
- Reject name lengths that would overflow m when added to sizeof(word32), preventing OOB reads on later checks. Issue: F-1277pull/977/head
parent
11e407f7db
commit
822c09d0eb
|
|
@ -144,6 +144,9 @@ static int ParseRFC6187(const byte* in, word32 inSz, byte** leafOut,
|
|||
|
||||
/* Skip the name */
|
||||
ato32(in, &l);
|
||||
if (l > inSz - sizeof(word32))
|
||||
return WS_BUFFER_E;
|
||||
|
||||
m += l + sizeof(word32);
|
||||
|
||||
/* Get the cert count */
|
||||
|
|
|
|||
Loading…
Reference in New Issue