WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

wolfssl_local_MatchBaseName: fix 1-byte read out of bounds looking for "@" 

Fixes F-7106
pull/11237/head
Josh Holtrop 2026-08-21 15:47:05 -04:00
parent 4d1bd552d0
commit 4eb192d4c8
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
tests/api/test_asn.c
View File

@ -1036,6 +1036,33 @@ int test_wolfssl_local_MatchBaseName(void)
ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
"user@domain.com", 15, "user@", 5), 0);
/* Regression: the scan for '@' in the base must test the length bound
* before dereferencing. The base is passed with an explicit length and
* is not required to be NUL terminated, so a bare-domain constraint
* (no '@' anywhere in it) used to read base[baseSz]. Run the same
* cases against a heap buffer holding exactly baseSz bytes with no
* terminator, so that the over-read is a heap overflow that ASAN or
* valgrind will catch. */
{
const char* bases[] = { "domain.com", ".domain.com", "user@domain.com" };
const int expect[] = { 1, 0, 1 };
size_t i;
for (i = 0; i < XELEM_CNT(bases); i++) {
char* base = NULL;
int baseSz = (int)XSTRLEN(bases[i]);
ExpectNotNull(base = (char*)XMALLOC((size_t)baseSz, NULL,
DYNAMIC_TYPE_TMP_BUFFER));
if (base != NULL) {
XMEMCPY(base, bases[i], (size_t)baseSz);
ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
"user@domain.com", 15, base, baseSz), expect[i]);
XFREE(base, NULL, DYNAMIC_TYPE_TMP_BUFFER);
}
}
}
/*
* Tests for directory type (ASN_DIR_TYPE = 0x04)
*

2
wolfcrypt/src/asn.c
View File

@ -19236,7 +19236,7 @@ int wolfssl_local_MatchBaseName(int type, const char* name, int nameSz,
count = 0;
/* find the '@' in the base */
while (*p != '@' && count < baseSz) {
while (count < baseSz && *p != '@') {
count++;
p++;
}