Gilles Peskine 78e54b9b1d x509_crl_parse: fix 1-byte buffer overflow and entry->raw.tag ... In the entries (mbedtls_x509_crl_entry values) on the list constructed by mbedtls_x509_crl_parse_der(), set entry->raw.tag to (SEQUENCE | CONSTRUCTED) rather than to the tag of the first ASN.1 element of the entry (which happens to be the tag of the serial number, so INTEGER or INTEGER | CONTEXT_SPECIFIC). This is doesn't really matter in practice (and in particular the value is never used in Mbed TLS itself), and isn't documented, but at least it's consistent with how mbedtls_x509_buf is normally used. The primary importance of this change is that the old code tried to access the tag of the first element of the entry even when the entry happened to be empty. If the entry was empty and not followed by anything else in the CRL, this could cause a read 1 byte after the end of the buffer containing the CRL. The test case "X509 CRL ASN1 (TBSCertList, single empty entry at end)" hit the problematic buffer overflow, which is detected with ASan. Credit to OSS-Fuzz for detecting the problem. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>		2020-08-12 12:51:43 +02:00
..
00README.md	Copy the changelog entry assembling script from development	2020-04-21 18:36:17 +02:00
x509parse_crl-empty_entry.txt	x509_crl_parse: fix 1-byte buffer overflow and entry->raw.tag	2020-08-12 12:51:43 +02:00