WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

certman: check the notAfter date parse in CheckProfile 

- Zero-initialize struct tm t; it was read indeterminate when the parse
  failed.
- Fail the profile when wc_GetDateAsCalendarTime() returns non-zero, and
  gate the two date-format comparisons on valid.

Issue: F-7208
pull/1144/head
John Safranek 2026-07-30 13:50:24 -07:00 committed by philljj
parent 0883b9b868
commit dc6c22bf98
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/certman.c
View File

@ -508,20 +508,24 @@ static int CheckProfile(DecodedCert* cert, int profile)
const byte* date;
int dateSz;
byte dateFormat;
struct tm t;
struct tm t = { 0 };
dateFormat = cert->afterDate[0]; /* i.e ASN_UTC_TIME */
dateSz = cert->afterDate[1];
date = &cert->afterDate[2];
wc_GetDateAsCalendarTime(date, dateSz, dateFormat, &t);
if (t.tm_year <= 149 && dateFormat != ASN_UTC_TIME) {
if (wc_GetDateAsCalendarTime(date, dateSz, dateFormat, &t) != 0) {
WLOG(WS_LOG_CERTMAN, "unable to get date");
valid = 0;
}
if (valid && t.tm_year <= 149 && dateFormat != ASN_UTC_TIME) {
WLOG(WS_LOG_CERTMAN, "date format was not utc for year %d",
t.tm_year);
valid = 0;
}
if (t.tm_year > 149 && dateFormat != ASN_GENERALIZED_TIME) {
if (valid && t.tm_year > 149 && dateFormat != ASN_GENERALIZED_TIME) {
WLOG(WS_LOG_CERTMAN, "date format was not general for year %d",
t.tm_year);
valid = 0;