romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 01:03:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

x509asn1: add parse recursion limit

Browse source 
For ASN.1 tags with indefinite length, curl's own parser for TLS
backends that do not support certificate inspection calls itself
recursively. A malicious server certificate can then lead to high
recursion level exhausting the stack space.

This PR limits the recursion level to 16 which should be safe on all
architectures.

Added unit test 1657 to verify behaviour.

Fixes #16135
Reported-by: z2_
Closes #16137
This commit is contained in:
Stefan Eissing 2025-01-31 13:13:34 +01:00 • committed by Daniel Stenberg
parent dc3252bedd
commit 65fca12e63
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 188 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -218,7 +218,7 @@ test1620 test1621 \
\
test1630 test1631 test1632 test1633 test1634 test1635 \
\
test1650 test1651 test1652 test1653 test1654 test1655 test1656 \
test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
test1660 test1661 test1662 test1663 test1664 \
\
test1670 test1671 \

22
tests/data/test1657 Normal file
View file

@ -0,0 +1,22 @@
<testcase>
<info>
<keywords>
unittest
Curl_x509_getASN1Element
</keywords>
</info>
#
# Client-side
<client>
<server>
none
</server>
<features>
unittest
</features>
<name>
Curl_x509_getASN1Element unit tests
</name>
</client>
</testcase>