root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Add NULL checks where ContentInfo data can be NULL 

PKCS12 structures contain PKCS7 ContentInfo fields. These fields are
optional and can be NULL even if the "type" is a valid value. OpenSSL
was not properly accounting for this and a NULL dereference can occur
causing a crash.

CVE-2024-0727

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23361)
This commit is contained in:
Matt Caswell 2024-01-19 11:28:58 +00:00
parent 72062fca28
commit 041962b429
4 changed files with 31 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
crypto/pkcs12/p12_add.c
View File

@ -78,6 +78,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7)
ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA);
return NULL;
}
if (p7->d.data == NULL) {
ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
return NULL;
}
return ASN1_item_unpack_ex(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
ossl_pkcs7_ctx_get0_libctx(&p7->ctx),
ossl_pkcs7_ctx_get0_propq(&p7->ctx));
@ -152,6 +158,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass,
{
if (!PKCS7_type_is_encrypted(p7))
return NULL;
if (p7->d.encrypted == NULL) {
ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
return NULL;
}
return PKCS12_item_decrypt_d2i_ex(p7->d.encrypted->enc_data->algorithm,
ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
pass, passlen,
@ -191,6 +203,12 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12)
ERR_raise(ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA);
return NULL;
}
if (p12->authsafes->d.data == NULL) {
ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
return NULL;
}
p7ctx = &p12->authsafes->ctx;
p7s = ASN1_item_unpack_ex(p12->authsafes->d.data,
ASN1_ITEM_rptr(PKCS12_AUTHSAFES),

5
crypto/pkcs12/p12_mutl.c
View File

@ -98,6 +98,11 @@ static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
return 0;
}
if (p12->authsafes->d.data == NULL) {
ERR_raise(ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR);
return 0;
}
salt = p12->mac->salt->data;
saltlen = p12->mac->salt->length;
if (p12->mac->iter == NULL)

5
crypto/pkcs12/p12_npas.c
View File

@ -80,8 +80,9 @@ static int newpass_p12(PKCS12 *p12, const char *oldpass, const char *newpass)
bags = PKCS12_unpack_p7data(p7);
} else if (bagnid == NID_pkcs7_encrypted) {
bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
if (!alg_get(p7->d.encrypted->enc_data->algorithm,
&pbe_nid, &pbe_iter, &pbe_saltlen, &cipherid))
if (p7->d.encrypted == NULL
|| !alg_get(p7->d.encrypted->enc_data->algorithm,
&pbe_nid, &pbe_iter, &pbe_saltlen, &cipherid))
goto err;
} else {
continue;

7
crypto/pkcs7/pk7_mime.c
View File

@ -33,10 +33,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
int ctype_nid = OBJ_obj2nid(p7->type);
const PKCS7_CTX *ctx = ossl_pkcs7_get0_ctx(p7);
if (ctype_nid == NID_pkcs7_signed)
if (ctype_nid == NID_pkcs7_signed) {
if (p7->d.sign == NULL)
return 0;
mdalgs = p7->d.sign->md_algs;
else
} else {
mdalgs = NULL;
}
flags ^= SMIME_OLDMIME;