romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 06:47:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel_verify: avoid out of blob access

Browse source 
The code would previously read one byte past the provided
CURLOPT_CAINFO_BLOB if the blob ends exactly with -----BEGIN
CERTIFICATE-----

Reported-by: Andrew Nesbit
Closes #21543
This commit is contained in:
Daniel Stenberg 2026-05-10 15:13:59 +02:00
parent b944940828
commit ea75ccc53b
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 3 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/vtls/schannel_verify.c
View file

@ -92,11 +92,6 @@ struct cert_chain_engine_config_win7 {
HCERTSTORE hExclusiveTrustedPeople;
};
static int is_cr_or_lf(char c)
{
return c == '\r' || c == '\n';
}
/* Search the substring needle,needlelen into string haystack,haystacklen
* Strings do not need to be terminated by a '\0'.
* Similar of macOS/Linux memmem (not available on Visual Studio).
@ -134,10 +129,11 @@ static CURLcode add_certs_data_to_store(HCERTSTORE trust_store,
while(more_certs && (current_ca_file_ptr < ca_buffer_limit)) {
const char *begin_cert_ptr = c_memmem(current_ca_file_ptr,
ca_buffer_limit-current_ca_file_ptr,
ca_buffer_limit -
current_ca_file_ptr - 1,
BEGIN_CERT,
begin_cert_len);
if(!begin_cert_ptr || !is_cr_or_lf(begin_cert_ptr[begin_cert_len])) {
if(!begin_cert_ptr || !ISNEWLINE(begin_cert_ptr[begin_cert_len])) {
more_certs = 0;
}
else {