Potential buffer overwrite in pem_write_buffer() fixed
Length indication when given a too small buffer was off.
Added regression test in test_suite_pem to detect this.
diff --git a/library/pem.c b/library/pem.c
index 2c9d10d..1cc23ba 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -382,10 +382,11 @@
{
int ret;
unsigned char *encode_buf, *c, *p = buf;
- size_t len = 0, use_len = 0;
- size_t add_len = strlen( header ) + strlen( footer ) + ( use_len / 64 ) + 1;
+ size_t len = 0, use_len = 0, add_len = 0;
base64_encode( NULL, &use_len, der_data, der_len );
+ add_len = strlen( header ) + strlen( footer ) + ( use_len / 64 ) + 1;
+
if( use_len + add_len > buf_len )
{
*olen = use_len + add_len;