romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-30 02:18:03 +03:00
Code Issues Projects Releases Packages Wiki Activity

rustls: cap maximum allowed CRL file size to 8MB

Browse source 
Allowing 4GB on a 32-bit system is just asking for problems and could in
theory cause integer overflow in the dynbuf code.

The dynbuf now has an assert to catch code trying to set a max larger
than half SIZE_T_MAX.

Reported-by: Rinku Das
Closes #16716
This commit is contained in:
Daniel Stenberg 2025-03-14 08:28:02 +01:00
parent 27e07b2943
commit 116f490c81
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
lib/dynbuf.c
View file

@ -43,6 +43,7 @@ void Curl_dyn_init(struct dynbuf *s, size_t toobig)
{
DEBUGASSERT(s);
DEBUGASSERT(toobig);
DEBUGASSERT(toobig <= MAX_DYNBUF_SIZE); /* catch crazy mistakes */
s->bufr = NULL;
s->leng = 0;
s->allc = 0;

3
lib/dynbuf.h
View file

@ -81,6 +81,8 @@ int Curl_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list ap_save);
char *Curl_dyn_take(struct dynbuf *s, size_t *plen);
/* Dynamic buffer max sizes */
#define MAX_DYNBUF_SIZE (SIZE_T_MAX/2)
#define DYN_DOH_RESPONSE 3000
#define DYN_DOH_CNAME 256
#define DYN_PAUSE_BUFFER (64 * 1024 * 1024)
@ -95,4 +97,5 @@ char *Curl_dyn_take(struct dynbuf *s, size_t *plen);
#define DYN_PINGPPONG_CMD (64*1024)
#define DYN_IMAP_CMD (64*1024)
#define DYN_MQTT_RECV (64*1024)
#define DYN_CRLFILE_SIZE 8000000
#endif

2
lib/vtls/rustls.c
View file

@ -708,7 +708,7 @@ cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
if(conn_config->CRLfile) {
struct dynbuf crl_contents;
Curl_dyn_init(&crl_contents, SIZE_MAX);
Curl_dyn_init(&crl_contents, DYN_CRLFILE_SIZE);
if(!read_file_into(conn_config->CRLfile, &crl_contents)) {
failf(data, "rustls: failed to read revocation list file");
Curl_dyn_free(&crl_contents);