isaacpittman-hitachi / rpms / openssl

Forked from rpms/openssl 2 years ago
Clone
3da501
From 2f7530077e0ef79d98718138716bc51ca0cad658 Mon Sep 17 00:00:00 2001
3da501
From: Hugo Landau <hlandau@openssl.org>
3da501
Date: Tue, 17 Jan 2023 17:45:42 +0000
3da501
Subject: [PATCH 14/18] CVE-2023-0286: Fix GENERAL_NAME_cmp for x400Address
3da501
 (3.0)
3da501
3da501
Reviewed-by: Paul Dale <pauli@openssl.org>
3da501
Reviewed-by: Tomas Mraz <tomas@openssl.org>
3da501
---
3da501
 CHANGES.md                  | 19 +++++++++++++++++++
3da501
 crypto/x509/v3_genn.c       |  2 +-
3da501
 include/openssl/x509v3.h.in |  2 +-
3da501
 test/v3nametest.c           |  8 ++++++++
3da501
 4 files changed, 29 insertions(+), 2 deletions(-)
3da501
3da501
diff --git a/crypto/x509/v3_genn.c b/crypto/x509/v3_genn.c
3da501
index c0a7166cd0..1741c2d2f6 100644
3da501
--- a/crypto/x509/v3_genn.c
3da501
+++ b/crypto/x509/v3_genn.c
3da501
@@ -98,7 +98,7 @@ int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b)
3da501
         return -1;
3da501
     switch (a->type) {
3da501
     case GEN_X400:
3da501
-        result = ASN1_TYPE_cmp(a->d.x400Address, b->d.x400Address);
3da501
+        result = ASN1_STRING_cmp(a->d.x400Address, b->d.x400Address);
3da501
         break;
3da501
 
3da501
     case GEN_EDIPARTY:
3da501
diff --git a/include/openssl/x509v3.h.in b/include/openssl/x509v3.h.in
3da501
index d00a66a343..c087e3cf92 100644
3da501
--- a/include/openssl/x509v3.h.in
3da501
+++ b/include/openssl/x509v3.h.in
3da501
@@ -154,7 +154,7 @@ typedef struct GENERAL_NAME_st {
3da501
         OTHERNAME *otherName;   /* otherName */
3da501
         ASN1_IA5STRING *rfc822Name;
3da501
         ASN1_IA5STRING *dNSName;
3da501
-        ASN1_TYPE *x400Address;
3da501
+        ASN1_STRING *x400Address;
3da501
         X509_NAME *directoryName;
3da501
         EDIPARTYNAME *ediPartyName;
3da501
         ASN1_IA5STRING *uniformResourceIdentifier;
3da501
diff --git a/test/v3nametest.c b/test/v3nametest.c
3da501
index 6d2e2f8e27..0341995dde 100644
3da501
--- a/test/v3nametest.c
3da501
+++ b/test/v3nametest.c
3da501
@@ -644,6 +644,14 @@ static struct gennamedata {
3da501
             0xb7, 0x09, 0x02, 0x02
3da501
         },
3da501
         15
3da501
+    }, {
3da501
+        /*
3da501
+         * Regression test for CVE-2023-0286.
3da501
+         */
3da501
+        {
3da501
+            0xa3, 0x00
3da501
+        },
3da501
+        2
3da501
     }
3da501
 };
3da501
 
3da501
-- 
3da501
2.39.1
3da501