From 6f400a376eb83ea139cf149c388ea3ce0634d753 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Mon, 1 May 2023 05:26:47 -0400 Subject: [PATCH 1/2] Disallow leading zeroes when parsing IPv4 addresses Signed-off-by: Andrzej Kurek --- library/x509_crt.c | 8 +++++++- tests/suites/test_suite_x509parse.data | 6 ++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index 874d8f607..61929bea6 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -2667,7 +2667,6 @@ static int x509_inet_pton_ipv6(const char *src, void *dst) static int x509_inet_pton_ipv4(const char *src, void *dst) { - /* note: allows leading 0's, e.g. 000.000.000.000 */ const unsigned char *p = (const unsigned char *) src; uint8_t *res = (uint8_t *) dst; uint8_t digit, num_digits = 0; @@ -2681,6 +2680,13 @@ static int x509_inet_pton_ipv4(const char *src, void *dst) if (digit > 9) { break; } + + /* Don't allow leading zeroes. These might mean octal format, + * which this implementation does not support. */ + if (octet == 0 && num_digits > 0) { + break; + } + octet = octet * 10 + digit; num_digits++; p++; diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index a6b001fb1..251cb0fef 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -1046,6 +1046,12 @@ x509_verify:"data_files/server5-tricky-ip-san.crt":"data_files/server5-tricky-ip X509 CRT parse CN: IPv4 valid address x509_crt_parse_cn_inet_pton:"10.10.10.10":"0A0A0A0A":4 +X509 CRT parse CN: IPv4 leading zeroes #1 +x509_crt_parse_cn_inet_pton:"010.10.10.10":"":0 + +X509 CRT parse CN: IPv4 leading zeroes #2 +x509_crt_parse_cn_inet_pton:"10.10.10.001":"":0 + X509 CRT parse CN: IPv4 excess 0s x509_crt_parse_cn_inet_pton:"10.0000.10.10":"":0 From 9c9880a63f5a7aade75df1a7c982e1875ddd1aa3 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Wed, 3 May 2023 05:06:47 -0400 Subject: [PATCH 2/2] Explicitly exit IPv4 parsing on a fatal error This makes the function flow more readable. Signed-off-by: Andrzej Kurek --- library/x509_crt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index 61929bea6..6a27e9241 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -2684,7 +2684,7 @@ static int x509_inet_pton_ipv4(const char *src, void *dst) /* Don't allow leading zeroes. These might mean octal format, * which this implementation does not support. */ if (octet == 0 && num_digits > 0) { - break; + return -1; } octet = octet * 10 + digit; @@ -2693,7 +2693,7 @@ static int x509_inet_pton_ipv4(const char *src, void *dst) } while (num_digits < 3); if (octet >= 256 || num_digits > 3 || num_digits == 0) { - break; + return -1; } *res++ = (uint8_t) octet; num_octets++;