From 2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 Mon Sep 17 00:00:00 2001 From: Hugo Landau Date: Tue, 17 Jan 2023 17:45:42 +0000 Subject: [PATCH 6/6] CVE-2023-0286: Fix GENERAL_NAME_cmp for x400Address (1.1.1) Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz --- CHANGES | 18 +++++++++++++++++- crypto/x509v3/v3_genn.c | 2 +- include/openssl/x509v3.h | 2 +- test/v3nametest.c | 8 ++++++++ 4 files changed, 27 insertions(+), 3 deletions(-) diff --git a/crypto/x509v3/v3_genn.c b/crypto/x509v3/v3_genn.c index 87a5eff47c..e54ddc55c9 100644 --- a/crypto/x509v3/v3_genn.c +++ b/crypto/x509v3/v3_genn.c @@ -98,7 +98,7 @@ int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b) return -1; switch (a->type) { case GEN_X400: - result = ASN1_TYPE_cmp(a->d.x400Address, b->d.x400Address); + result = ASN1_STRING_cmp(a->d.x400Address, b->d.x400Address); break; case GEN_EDIPARTY: diff --git a/include/openssl/x509v3.h b/include/openssl/x509v3.h index 90fa3592ce..e61c0f29d4 100644 --- a/include/openssl/x509v3.h +++ b/include/openssl/x509v3.h @@ -136,7 +136,7 @@ typedef struct GENERAL_NAME_st { OTHERNAME *otherName; /* otherName */ ASN1_IA5STRING *rfc822Name; ASN1_IA5STRING *dNSName; - ASN1_TYPE *x400Address; + ASN1_STRING *x400Address; X509_NAME *directoryName; EDIPARTYNAME *ediPartyName; ASN1_IA5STRING *uniformResourceIdentifier; diff --git a/test/v3nametest.c b/test/v3nametest.c index d1852190b8..37819da8fd 100644 --- a/test/v3nametest.c +++ b/test/v3nametest.c @@ -646,6 +646,14 @@ static struct gennamedata { 0xb7, 0x09, 0x02, 0x02 }, 15 + }, { + /* + * Regression test for CVE-2023-0286. + */ + { + 0xa3, 0x00 + }, + 2 } }; -- 2.39.1