diff options
Diffstat (limited to 'gnu/packages/patches/libtasn1-CVE-2018-6003.patch')
| -rw-r--r-- | gnu/packages/patches/libtasn1-CVE-2018-6003.patch | 73 |
1 files changed, 0 insertions, 73 deletions
diff --git a/gnu/packages/patches/libtasn1-CVE-2018-6003.patch b/gnu/packages/patches/libtasn1-CVE-2018-6003.patch deleted file mode 100644 index 3e6140518d..0000000000 --- a/gnu/packages/patches/libtasn1-CVE-2018-6003.patch +++ /dev/null @@ -1,73 +0,0 @@ -Fix CVE-2018-6003: - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6003 -https://lists.gnu.org/archive/html/help-libtasn1/2018-01/msg00000.html - -Patch copied from upstream source repository: - -https://gitlab.com/gnutls/libtasn1/commit/c593ae84cfcde8fea45787e53950e0ac71e9ca97 - -From c593ae84cfcde8fea45787e53950e0ac71e9ca97 Mon Sep 17 00:00:00 2001 -From: Nikos Mavrogiannopoulos <nmav@redhat.com> -Date: Thu, 4 Jan 2018 10:52:05 +0100 -Subject: [PATCH] _asn1_decode_simple_ber: restrict the levels of recursion to 3 - -On indefinite string decoding, setting a maximum level of recursions -protects the BER decoder from a stack exhaustion due to large amounts -of recursion. - -Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> ---- - lib/decoding.c | 21 +++++++++++++++++++-- - 1 file changed, 19 insertions(+), 2 deletions(-) - -diff --git a/lib/decoding.c b/lib/decoding.c -index 2240b09..0ee35d3 100644 ---- a/lib/decoding.c -+++ b/lib/decoding.c -@@ -45,6 +45,13 @@ - - #define DECODE_FLAG_HAVE_TAG 1 - #define DECODE_FLAG_INDEFINITE (1<<1) -+/* On indefinite string decoding, allow this maximum levels -+ * of recursion. Allowing infinite recursion, makes the BER -+ * decoder susceptible to stack exhaustion due to that recursion. -+ */ -+#define DECODE_FLAG_LEVEL1 (1<<2) -+#define DECODE_FLAG_LEVEL2 (1<<3) -+#define DECODE_FLAG_LEVEL3 (1<<4) - - #define DECR_LEN(l, s) do { \ - l -= s; \ -@@ -2216,7 +2223,8 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, - } - - /* indefinite constructed */ -- if (((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) -+ if ((((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) && -+ !(dflags & DECODE_FLAG_LEVEL3)) - { - len_len = 1; - -@@ -2236,8 +2244,17 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, - do - { - unsigned tmp_len; -+ unsigned flags = DECODE_FLAG_HAVE_TAG; -+ -+ if (dflags & DECODE_FLAG_LEVEL1) -+ flags |= DECODE_FLAG_LEVEL2; -+ else if (dflags & DECODE_FLAG_LEVEL2) -+ flags |= DECODE_FLAG_LEVEL3; -+ else -+ flags |= DECODE_FLAG_LEVEL1; - -- result = asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len); -+ result = _asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len, -+ flags); - if (result != ASN1_SUCCESS) - { - warn(); --- -libgit2 0.26.0 - |