Add missing bounds check in X509 DER write funcs
This patch adds checks in both mbedtls_x509write_crt_der and
mbedtls_x509write_csr_der before the signature is written to buf
using memcpy().
diff --git a/library/x509write_csr.c b/library/x509write_csr.c
index c5a5875..1b3d2f5 100644
--- a/library/x509write_csr.c
+++ b/library/x509write_csr.c
@@ -214,6 +214,9 @@
ASN1_CHK_ADD( sig_and_oid_len, x509_write_sig( &c2, buf,
sig_oid, sig_oid_len, sig, sig_len ) );
+ if( len > (size_t)( c2 - buf ) )
+ return( POLARSSL_ERR_ASN1_BUF_TOO_SMALL );
+
c2 -= len;
memcpy( c2, c, len );