Fix use of pem_read_buffer() in PK, DHM and X509
diff --git a/library/x509_crl.c b/library/x509_crl.c
index a915aba..fc4b2df 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -503,6 +503,11 @@
do
{
mbedtls_pem_init( &pem );
+
+ /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
+ if( buf[buflen - 1] != '\0' )
+ ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
+ else
ret = mbedtls_pem_read_buffer( &pem,
"-----BEGIN X509 CRL-----",
"-----END X509 CRL-----",
@@ -532,7 +537,9 @@
return( ret );
}
}
- while( is_pem && buflen > 0 );
+ /* In the PEM case, buflen is 1 at the end, for the terminated NULL byte.
+ * And a valid CRL cannot be less than 1 byte anyway. */
+ while( is_pem && buflen > 1 );
if( is_pem )
return( 0 );
@@ -556,7 +563,7 @@
ret = mbedtls_x509_crl_parse( chain, buf, n );
- mbedtls_zeroize( buf, n + 1 );
+ mbedtls_zeroize( buf, n );
mbedtls_free( buf );
return( ret );