From 09a2f72584bb52ba87a97ee291729d6609229626 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 20 Feb 2017 11:13:08 +0100 Subject: cdk_pkt_read: enforce packet limits That ensures that there are no overflows in the subsequent calculations. Resolves the oss-fuzz found bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 Relates: #159 Signed-off-by: Nikos Mavrogiannopoulos --- lib/opencdk/read-packet.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/opencdk/read-packet.c b/lib/opencdk/read-packet.c index 8a8d87a1fd..d95845d569 100644 --- a/lib/opencdk/read-packet.c +++ b/lib/opencdk/read-packet.c @@ -951,6 +951,7 @@ static cdk_error_t skip_packet(cdk_stream_t inp, size_t pktlen) return 0; } +#define MAX_PACKET_LEN (1<<24) /** * cdk_pkt_read: @@ -1003,6 +1004,13 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt) else read_old_length(inp, ctb, &pktlen, &pktsize); + /* enforce limits to ensure that the following calculations + * do not overflow */ + if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) { + _cdk_log_info("cdk_pkt_read: too long packet\n"); + return gnutls_assert_val(CDK_Inv_Packet); + } + pkt->pkttype = pkttype; pkt->pktlen = pktlen; pkt->pktsize = pktsize + pktlen; @@ -1027,6 +1035,7 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt) break; case CDK_PKT_USER_ID: + pkt->pkt.user_id = cdk_calloc(1, sizeof *pkt->pkt.user_id + pkt->pktlen + 1); if (!pkt->pkt.user_id) -- cgit v1.2.1