|
 |
1ac26c |
From 934a04f0e775309cadbef0aa6b9692e1b12a76c6 Mon Sep 17 00:00:00 2001
|
|
|
1ac26c |
From: Tomas Mraz <tomas@openssl.org>
|
|
|
1ac26c |
Date: Mon, 16 Jan 2023 19:45:23 +0100
|
|
|
1ac26c |
Subject: [PATCH 08/18] Do not dereference PKCS7 object data if not set
|
|
|
1ac26c |
|
|
|
1ac26c |
Fixes CVE-2023-0216
|
|
|
1ac26c |
|
|
|
1ac26c |
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
|
|
|
1ac26c |
Reviewed-by: Paul Dale <pauli@openssl.org>
|
|
|
1ac26c |
---
|
|
|
1ac26c |
crypto/pkcs7/pk7_lib.c | 16 ++++++++++++----
|
|
|
1ac26c |
1 file changed, 12 insertions(+), 4 deletions(-)
|
|
|
1ac26c |
|
|
|
1ac26c |
diff --git a/crypto/pkcs7/pk7_lib.c b/crypto/pkcs7/pk7_lib.c
|
|
|
1ac26c |
index 753f1276e6..936e50da54 100644
|
|
|
1ac26c |
--- a/crypto/pkcs7/pk7_lib.c
|
|
|
1ac26c |
+++ b/crypto/pkcs7/pk7_lib.c
|
|
|
1ac26c |
@@ -414,6 +414,8 @@ PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, EVP_PKEY *pkey,
|
|
|
1ac26c |
|
|
|
1ac26c |
static STACK_OF(X509) *pkcs7_get_signer_certs(const PKCS7 *p7)
|
|
|
1ac26c |
{
|
|
|
1ac26c |
+ if (p7->d.ptr == NULL)
|
|
|
1ac26c |
+ return NULL;
|
|
|
1ac26c |
if (PKCS7_type_is_signed(p7))
|
|
|
1ac26c |
return p7->d.sign->cert;
|
|
|
1ac26c |
if (PKCS7_type_is_signedAndEnveloped(p7))
|
|
|
1ac26c |
@@ -423,6 +425,8 @@ static STACK_OF(X509) *pkcs7_get_signer_certs(const PKCS7 *p7)
|
|
|
1ac26c |
|
|
|
1ac26c |
static STACK_OF(PKCS7_RECIP_INFO) *pkcs7_get_recipient_info(const PKCS7 *p7)
|
|
|
1ac26c |
{
|
|
|
1ac26c |
+ if (p7->d.ptr == NULL)
|
|
|
1ac26c |
+ return NULL;
|
|
|
1ac26c |
if (PKCS7_type_is_signedAndEnveloped(p7))
|
|
|
1ac26c |
return p7->d.signed_and_enveloped->recipientinfo;
|
|
|
1ac26c |
if (PKCS7_type_is_enveloped(p7))
|
|
|
1ac26c |
@@ -440,13 +444,17 @@ void ossl_pkcs7_resolve_libctx(PKCS7 *p7)
|
|
|
1ac26c |
const PKCS7_CTX *ctx = ossl_pkcs7_get0_ctx(p7);
|
|
|
1ac26c |
OSSL_LIB_CTX *libctx = ossl_pkcs7_ctx_get0_libctx(ctx);
|
|
|
1ac26c |
const char *propq = ossl_pkcs7_ctx_get0_propq(ctx);
|
|
|
1ac26c |
- STACK_OF(PKCS7_RECIP_INFO) *rinfos = pkcs7_get_recipient_info(p7);
|
|
|
1ac26c |
- STACK_OF(PKCS7_SIGNER_INFO) *sinfos = PKCS7_get_signer_info(p7);
|
|
|
1ac26c |
- STACK_OF(X509) *certs = pkcs7_get_signer_certs(p7);
|
|
|
1ac26c |
+ STACK_OF(PKCS7_RECIP_INFO) *rinfos;
|
|
|
1ac26c |
+ STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
|
|
|
1ac26c |
+ STACK_OF(X509) *certs;
|
|
|
1ac26c |
|
|
|
1ac26c |
- if (ctx == NULL)
|
|
|
1ac26c |
+ if (ctx == NULL || p7->d.ptr == NULL)
|
|
|
1ac26c |
return;
|
|
|
1ac26c |
|
|
|
1ac26c |
+ rinfos = pkcs7_get_recipient_info(p7);
|
|
|
1ac26c |
+ sinfos = PKCS7_get_signer_info(p7);
|
|
|
1ac26c |
+ certs = pkcs7_get_signer_certs(p7);
|
|
|
1ac26c |
+
|
|
|
1ac26c |
for (i = 0; i < sk_X509_num(certs); i++)
|
|
|
1ac26c |
ossl_x509_set0_libctx(sk_X509_value(certs, i), libctx, propq);
|
|
|
1ac26c |
|
|
|
1ac26c |
--
|
|
|
1ac26c |
2.39.1
|
|
|
1ac26c |
|
|
|
1ac26c |
From 67813d8a4d110f4174bbd2fee8a2f15388e324b5 Mon Sep 17 00:00:00 2001
|
|
|
1ac26c |
From: Tomas Mraz <tomas@openssl.org>
|
|
|
1ac26c |
Date: Mon, 16 Jan 2023 19:56:20 +0100
|
|
|
1ac26c |
Subject: [PATCH 09/18] Add test for d2i_PKCS7 NULL dereference
|
|
|
1ac26c |
|
|
|
1ac26c |
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
|
|
|
1ac26c |
Reviewed-by: Paul Dale <pauli@openssl.org>
|
|
|
1ac26c |
---
|
|
|
1ac26c |
test/recipes/25-test_pkcs7.t | 7 +++++--
|
|
|
1ac26c |
test/recipes/25-test_pkcs7_data/malformed.pkcs7 | 3 +++
|
|
|
1ac26c |
2 files changed, 8 insertions(+), 2 deletions(-)
|
|
|
1ac26c |
create mode 100644 test/recipes/25-test_pkcs7_data/malformed.pkcs7
|
|
|
1ac26c |
|
|
|
1ac26c |
diff --git a/test/recipes/25-test_pkcs7.t b/test/recipes/25-test_pkcs7.t
|
|
|
1ac26c |
index 37cd43dc6b..d61cd6abad 100644
|
|
|
1ac26c |
--- a/test/recipes/25-test_pkcs7.t
|
|
|
1ac26c |
+++ b/test/recipes/25-test_pkcs7.t
|
|
|
1ac26c |
@@ -11,11 +11,11 @@ use strict;
|
|
|
1ac26c |
use warnings;
|
|
|
1ac26c |
|
|
|
1ac26c |
use File::Spec;
|
|
|
1ac26c |
-use OpenSSL::Test qw/:DEFAULT srctop_file/;
|
|
|
1ac26c |
+use OpenSSL::Test qw/:DEFAULT srctop_file data_file/;
|
|
|
1ac26c |
|
|
|
1ac26c |
setup("test_pkcs7");
|
|
|
1ac26c |
|
|
|
1ac26c |
-plan tests => 3;
|
|
|
1ac26c |
+plan tests => 4;
|
|
|
1ac26c |
|
|
|
1ac26c |
require_ok(srctop_file('test','recipes','tconversion.pl'));
|
|
|
1ac26c |
|
|
|
1ac26c |
@@ -27,3 +27,6 @@ subtest 'pkcs7 conversions -- pkcs7d' => sub {
|
|
|
1ac26c |
tconversion( -type => 'p7d', -in => srctop_file("test", "pkcs7-1.pem"),
|
|
|
1ac26c |
-args => ["pkcs7"] );
|
|
|
1ac26c |
};
|
|
|
1ac26c |
+
|
|
|
1ac26c |
+my $malformed = data_file('malformed.pkcs7');
|
|
|
1ac26c |
+ok(run(app(["openssl", "pkcs7", "-in", $malformed])));
|
|
|
1ac26c |
diff --git a/test/recipes/25-test_pkcs7_data/malformed.pkcs7 b/test/recipes/25-test_pkcs7_data/malformed.pkcs7
|
|
|
1ac26c |
new file mode 100644
|
|
|
1ac26c |
index 0000000000..e30d1b582c
|
|
|
1ac26c |
--- /dev/null
|
|
|
1ac26c |
+++ b/test/recipes/25-test_pkcs7_data/malformed.pkcs7
|
|
|
1ac26c |
@@ -0,0 +1,3 @@
|
|
|
1ac26c |
+-----BEGIN PKCS7-----
|
|
|
1ac26c |
+MAsGCSqGSIb3DQEHAg==
|
|
|
1ac26c |
+-----END PKCS7-----
|
|
|
1ac26c |
--
|
|
|
1ac26c |
2.39.1
|
|
|
1ac26c |
|