Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix read at invalid address in X509 extension parser.

Browse source 
When encountering an extension unknown to OpenSSL, we would read from
the wrong memory location. Also added a testcase to prevent this specific
case from happening again.
This commit is contained in:
Johanna Amann 2018-06-04 11:43:20 -07:00
parent 19b893a5bc
commit a891517762
3 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/file_analysis/analyzer/x509/X509Common.cc
View file

@ -244,7 +244,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, EventHandlerP
int len = i2d_ASN1_OCTET_STRING(X509_EXTENSION_get_data(ex), &buf); int len = i2d_ASN1_OCTET_STRING(X509_EXTENSION_get_data(ex), &buf);
if ( len >=0 ) if ( len >=0 )
{ {
BIO_write(bio, &buf, len); BIO_write(bio, buf, len);
OPENSSL_free(buf); OPENSSL_free(buf);
} }
} }

4
testing/btest/Baseline/scripts.base.protocols.ssl.x509-invalid-extension/.stdout Normal file
View file

@ -0,0 +1,4 @@
UNDEF
\x04a0_\xa1]\xa0[0Y0W0U\x16\x09image/gif0!0\x1f0\x07\x06\x05+\x0e\x03\x02\x1a\x04\x14\x8f\xe5\xd3\x1a\x86\xac\x8d\x8ek\xc3\xcf\x80j\xd4H\x18,{\x19.0%\x16#http://logo.verisign.com/vslogo.gif
UNDEF
\x04a0_\xa1]\xa0[0Y0W0U\x16\x09image/gif0!0\x1f0\x07\x06\x05+\x0e\x03\x02\x1a\x04\x14\x8f\xe5\xd3\x1a\x86\xac\x8d\x8ek\xc3\xcf\x80j\xd4H\x18,{\x19.0%\x16#http://logo.verisign.com/vslogo.gif

11
testing/btest/scripts/base/protocols/ssl/x509-invalid-extension.test Normal file
View file

@ -0,0 +1,11 @@
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-stapling.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event x509_extension(f: fa_file, ext: X509::Extension)
{
if ( ext$oid != "1.3.6.1.5.5.7.1.12" )
return;
print ext$short_name;
print ext$value;
}