commit 47f3059780d1436a3708703b1ba2c6ec394631ba
author Andres AG <andres.amayagarcia@arm.com> Thu Mar 09 16:46:14 2017 +0000
committer Simon Butcher <simon.butcher@arm.com> Thu Jul 27 11:50:04 2017 +0100
tree 502e7239b9c0fde7f450592a7da51b420db6b332
parent 26124be17aedbb6984d824d932dea0d1f7b2b33d

Fix potential integer overflow parsing DER CRT

This patch prevents a potential signed integer overflow during the
certificate version verification checks.

library/x509_crt.c

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 8fa63c5..2b3eef7 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -619,14 +619,14 @@
         return( ret );
     }
 
-    crt->version++;
-
-    if( crt->version > 3 )
+    if( crt->version < 0 || crt->version > 2 )
     {
         x509_crt_free( crt );
         return( POLARSSL_ERR_X509_UNKNOWN_VERSION );
     }
 
+    crt->version++;
+
     if( ( ret = x509_get_sig_alg( &crt->sig_oid1, &sig_params1,
                                   &crt->sig_md, &crt->sig_pk,
                                   &crt->sig_opts ) ) != 0 )