[Openvpn-devel,1/2] crypto_openssl.c: fix heap-buffer-overflow found by AddressSanitizer

Message ID 1548154968-13019-1-git-send-email-lstipakov@gmail.com
State Superseded
Headers show
Series
  • [Openvpn-devel,1/2] crypto_openssl.c: fix heap-buffer-overflow found by AddressSanitizer
Related show

Commit Message

Lev Stipakov Jan. 22, 2019, 11:02 a.m.
From: Lev Stipakov <lev@openvpn.net>

OpenSSL's version of crypto_pem_encode() uses PEM_write_bio()
function to write PEM-encoded data to BIO object. That method doesn't
add NUL termanator, unlike its mbedTLS counterpart mbedtls_pem_write_buffer().

The code which uses PEM data treats it as a string, so missing NUL
terminator makes sanitizer to compain.

Fix by adding a NUL terminator.

Signed-off-by: Lev Stipakov <lev@openvpn.net>
---
 src/openvpn/crypto_openssl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Arne Schwabe Jan. 22, 2019, 12:36 p.m. | #1
Am 22.01.19 um 12:02 schrieb Lev Stipakov:
> From: Lev Stipakov <lev@openvpn.net>
> 
> OpenSSL's version of crypto_pem_encode() uses PEM_write_bio()
> function to write PEM-encoded data to BIO object. That method doesn't
> add NUL termanator, unlike its mbedTLS counterpart mbedtls_pem_write_buffer().
> 
> The code which uses PEM data treats it as a string, so missing NUL
> terminator makes sanitizer to compain.
> 
> Fix by adding a NUL terminator.
> 
> Signed-off-by: Lev Stipakov <lev@openvpn.net>
> ---
>  src/openvpn/crypto_openssl.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
> index 9691ce0..6a49067 100644
> --- a/src/openvpn/crypto_openssl.c
> +++ b/src/openvpn/crypto_openssl.c
> @@ -400,8 +400,9 @@ crypto_pem_encode(const char *name, struct buffer *dst,
>      BUF_MEM *bptr;
>      BIO_get_mem_ptr(bio, &bptr);
>  
> -    *dst = alloc_buf_gc(bptr->length, gc);
> +    *dst = alloc_buf_gc(bptr->length + 1, gc);
>      ASSERT(buf_write(dst, bptr->data, bptr->length));
> +    *BEND(dst) = '\0';

buf_null_terminate(dst) is a better function here :)

Otherwise ACK, fixes the problem.

Arne

Patch

diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
index 9691ce0..6a49067 100644
--- a/src/openvpn/crypto_openssl.c
+++ b/src/openvpn/crypto_openssl.c
@@ -400,8 +400,9 @@  crypto_pem_encode(const char *name, struct buffer *dst,
     BUF_MEM *bptr;
     BIO_get_mem_ptr(bio, &bptr);
 
-    *dst = alloc_buf_gc(bptr->length, gc);
+    *dst = alloc_buf_gc(bptr->length + 1, gc);
     ASSERT(buf_write(dst, bptr->data, bptr->length));
+    *BEND(dst) = '\0';
 
     ret = true;
 cleanup: