Fix potential random malloc in pem_read()
diff --git a/ChangeLog b/ChangeLog
index 0f8d4b8..d584090 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,10 @@
but might be in other uses. On 32 bit machines, requires reading a string
of close to or larger than 1GB to exploit; on 64 bit machines, would require
reading a string of close to or larger than 2^62 bytes.
+ * Fix potential random memory allocation in mbedtls_pem_read_buffer()
+ on crafted PEM input data. Found an fix provided by Guid Vranken.
+ Not triggerable remotely in TLS. Triggerable remotely if you accept PEM
+ data from an untrusted source.
= Version 1.2.16 released 2015-09-17
diff --git a/library/base64.c b/library/base64.c
index c94995b..dba4c23 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -176,7 +176,10 @@
}
if( n == 0 )
+ {
+ *dlen = 0;
return( 0 );
+ }
n = ((n * 6) + 7) >> 3;
n -= j;
diff --git a/library/pem.c b/library/pem.c
index 5c973ac..81098ee 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -287,6 +287,9 @@
#endif /* POLARSSL_MD5_C && (POLARSSL_AES_C || POLARSSL_DES_C) */
}
+ if( s1 == s2 )
+ return( POLARSSL_ERR_PEM_INVALID_DATA );
+
len = 0;
ret = base64_decode( NULL, &len, s1, s2 - s1 );