From b36495161037e52ad993202da5d3df1837235d24 Mon Sep 17 00:00:00 2001 From: Pekka Riikonen Date: Thu, 20 Mar 2008 08:35:48 +0200 Subject: [PATCH] Fixed possible buffer overflow in PKCS#1 message decoding. Vulnerability reported by Core Security Technologies. Thanks. --- lib/silccrypt/silcpkcs1.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/silccrypt/silcpkcs1.c b/lib/silccrypt/silcpkcs1.c index 283f1ab3..0a75f800 100644 --- a/lib/silccrypt/silcpkcs1.c +++ b/lib/silccrypt/silcpkcs1.c @@ -108,7 +108,7 @@ SilcBool silc_pkcs1_decode(SilcPkcs1BlockType bt, SilcUInt32 dest_data_size, SilcUInt32 *dest_len) { - int i = 0; + SilcUInt32 i = 0; SILC_LOG_DEBUG(("PKCS#1 decoding, bt %d", bt)); @@ -141,11 +141,19 @@ SilcBool silc_pkcs1_decode(SilcPkcs1BlockType bt, } /* Sanity checks */ + if (i >= data_len) { + SILC_LOG_DEBUG(("Malformed block")); + return FALSE; + } + if (i < SILC_PKCS1_MIN_PADDING) { + SILC_LOG_DEBUG(("Malformed block")); + return FALSE; + } if (data[i++] != 0x00) { SILC_LOG_DEBUG(("Malformed block")); return FALSE; } - if (i - 1 < SILC_PKCS1_MIN_PADDING) { + if (i >= data_len) { SILC_LOG_DEBUG(("Malformed block")); return FALSE; } -- 2.24.0