kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libseckey: Fix integer underflow for malformed SPKIs

Browse Source 
When the BER encoded BITRSTRING field has a zero length, then skipping
the unused-bits byte that a BITRSTING normally contains will cause a
underflow and thus may cause an out of bounds read by the caller of
sk_ep11_parse_spki().

Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-30 15:47:14 +02:00
committed by Jan Höppner
parent 5ab3473442
commit 220f51fb98
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libseckey/sk_ep11.c
View File

@@ -504,6 +504,8 @@ static int sk_ep11_parse_spki(const unsigned char *spki, size_t spki_len,
pub_key, pub_key_len);
if (tag != 0x03) /* BITSTRING */
return -EINVAL;
if (*pub_key_len == 0)
return -EINVAL;
/* skip unsused-bits byte */
(*pub_key)++;