cuberite/polarssl
1
0
Fork 0
mirror of https://github.com/cuberite/polarssl.git synced 2025-10-30 19:20:40 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential stack underflow in mpi_read_file.

Browse Source 
When provided with an empty line, mpi_read_file causes a numeric
underflow resulting in a stack underflow. This commit fixes this and
adds some documentation to mpi_read_file.
This commit is contained in:
Hanno Becker 2017-04-26 11:46:46 +01:00
parent b65c2be5f1
commit b2034b7785
3 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,5 +1,12 @@
mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS x.x.x branch released xxxx-xx-xx
Bugfix
* Fix potential stack underflow in mpi_read_file.
Found by Guido Vranken.
= mbed TLS 2.4.2 branch released 2017-03-08
Security

11
include/mbedtls/bignum.h
View File

@ -340,7 +340,7 @@ int mbedtls_mpi_write_string( const mbedtls_mpi *X, int radix,
#if defined(MBEDTLS_FS_IO)
/**
* \brief Read X from an opened file
* \brief Read MPI from a line in an opened file
*
* \param X Destination MPI
* \param radix Input numeric base
@ -349,6 +349,15 @@ int mbedtls_mpi_write_string( const mbedtls_mpi *X, int radix,
* \return 0 if successful, MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if
* the file read buffer is too small or a
* MBEDTLS_ERR_MPI_XXX error code
*
* \note On success, this function advances the file stream
* to the end of the current line or to EOF.
*
* The function returns 0 on an empty line.
*
* Leading whitespaces are ignored, as is a
* '0x' prefix for radix 16.
*
*/
int mbedtls_mpi_read_file( mbedtls_mpi *X, int radix, FILE *fin );

6
library/bignum.c
View File

@ -616,11 +616,11 @@ int mbedtls_mpi_read_file( mbedtls_mpi *X, int radix, FILE *fin )
if( slen == sizeof( s ) - 2 )
return( MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL );
if( s[slen - 1] == '\n' ) { slen--; s[slen] = '\0'; }
if( s[slen - 1] == '\r' ) { slen--; s[slen] = '\0'; }
if( slen > 0 && s[slen - 1] == '\n' ) { slen--; s[slen] = '\0'; }
if( slen > 0 && s[slen - 1] == '\r' ) { slen--; s[slen] = '\0'; }
p = s + slen;
while( --p >= s )
while( p-- > s )
if( mpi_get_digit( &d, radix, *p ) != 0 )
break;