yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix memory leak on error in pkcs7_get_signers_info_set

Browse source 
mbedtls_x509_name allocates memory, which must be freed if there is a
subsequent error.

Credit to OSS-Fuzz (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53811).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2022-11-27 22:02:10 +01:00
parent e7f8c616d0
commit 4f01121f6e
3 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
library/pkcs7.c
View file

@ -387,7 +387,7 @@ static int pkcs7_get_signers_info_set( unsigned char **p, unsigned char *end,
ret = pkcs7_get_signer_info( p, end_set, signers_set ); ret = pkcs7_get_signer_info( p, end_set, signers_set );
if( ret != 0 ) if( ret != 0 )
return( ret ); goto cleanup;
count++; count++;
mbedtls_pkcs7_signer_info *prev = signers_set; mbedtls_pkcs7_signer_info *prev = signers_set;

BIN
tests/data_files/pkcs7_get_signers_info_set-leak-fuzz_pkcs7-4541044530479104.der Normal file
View file

Binary file not shown.

3
tests/suites/test_suite_pkcs7.data
View file

@ -65,6 +65,9 @@ pkcs7_parse:"data_files/pkcs7_signerInfo_serial_invalid_size.der":MBEDTLS_ERR_PK
pkcs7_get_signers_info_set error handling (6213931373035520) pkcs7_get_signers_info_set error handling (6213931373035520)
pkcs7_parse:"data_files/pkcs7_get_signers_info_set-missing_free-fuzz_pkcs7-6213931373035520.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG pkcs7_parse:"data_files/pkcs7_get_signers_info_set-missing_free-fuzz_pkcs7-6213931373035520.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG
pkcs7_get_signers_info_set error handling (4541044530479104)
pkcs7_parse:"data_files/pkcs7_get_signers_info_set-missing_free-fuzz_pkcs7-6213931373035520.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG
PKCS7 Only Signed Data Parse Pass #15 PKCS7 Only Signed Data Parse Pass #15
depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
pkcs7_parse:"data_files/pkcs7_data_cert_signeddata_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA pkcs7_parse:"data_files/pkcs7_data_cert_signeddata_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA