diff options
| author |   guenther <guenther@openbsd.org> | 2016-10-02 20:45:04 +0000 |
|---|---|---|
| committer | guenther <guenther@openbsd.org> | 2016-10-02 20:45:04 +0000 |
| commit | 419769a60b9c9782cb5b537665731069dc22cb43 (patch) | |
| tree | 36cdcb2fde79a4f0c553c9c8616c1fdc73165fbf | |
| parent | The userspace TCB_GET() shouldn't take an argument (diff) | |
| download | wireguard-openbsd-419769a60b9c9782cb5b537665731069dc22cb43.tar.xz wireguard-openbsd-419769a60b9c9782cb5b537665731069dc22cb43.zip | |
In X509_cmp_time(), pass asn1_time_parse() the tag of the field being
parsed so that a malformed GeneralizedTime field is recognized as an error
instead of potentially being interpreted as if it was a valid UTCTime.
Reported by Theofilos Petsios (theofilos (at) cs.columbia.edu)
ok beck@ tedu@ jsing@
| -rw-r--r-- | lib/libcrypto/x509/x509_vfy.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/libcrypto/x509/x509_vfy.c b/lib/libcrypto/x509/x509_vfy.c index 5c043aa7b18..a9330e1c036 100644 --- a/lib/libcrypto/x509/x509_vfy.c +++ b/lib/libcrypto/x509/x509_vfy.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509_vfy.c,v 1.49 2016/03/11 07:08:45 mmcc Exp $ */ +/* $OpenBSD: x509_vfy.c,v 1.50 2016/10/02 20:45:04 guenther Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1658,7 +1658,8 @@ X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time) memset(&tm1, 0, sizeof(tm1)); - if ((type = asn1_time_parse(ctm->data, ctm->length, &tm1, 0)) == -1) + type = asn1_time_parse(ctm->data, ctm->length, &tm1, ctm->type); + if (type == -1) goto out; /* invalid time */ /* RFC 5280 section 4.1.2.5 */ |