浏览代码

LibCrypto: Fix bound checks when reading bitmaps

This only affects malformed RSA keys. Instead of accepting and
continuing with potentially broken pointers (and in ASAN, crashing), we
now consider bitmaps malformed, and stop parsing.

Found by OSS Fuzz: #31698, long-standing-bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31698

Fun fact: The "if" only exists because of OSS Fuzz.
8cc279ed74dc0b16a187052d2454c26c8c6ecaf2
Ben Wiederhake 4 年之前
父节点
当前提交
05d49cc0cb
共有 2 个文件被更改,包括 1 次插入4 次删除
  1. 1 1
      Userland/Libraries/LibCrypto/ASN1/DER.cpp
  2. 0 3
      Userland/Libraries/LibCrypto/PK/RSA.h

+ 1 - 1
Userland/Libraries/LibCrypto/ASN1/DER.cpp

@@ -176,7 +176,7 @@ Result<const BitmapView, DecodeError> Decoder::decode_bit_string(ReadonlyBytes d
         return DecodeError::InvalidInputFormat;
 
     auto unused_bits = data[0];
-    auto total_size_in_bits = data.size() * 8;
+    auto total_size_in_bits = (data.size() - 1) * 8;
 
     if (unused_bits > total_size_in_bits)
         return DecodeError::Overflow;

+ 0 - 3
Userland/Libraries/LibCrypto/PK/RSA.h

@@ -31,8 +31,6 @@ public:
     {
     }
 
-    //--stuff it should do
-
     const Integer& modulus() const { return m_modulus; }
     const Integer& public_exponent() const { return m_public_exponent; }
     size_t length() const { return m_length; }
@@ -66,7 +64,6 @@ public:
     {
     }
 
-    //--stuff it should do
     const Integer& modulus() const { return m_modulus; }
     const Integer& private_exponent() const { return m_private_exponent; }
     const Integer& public_exponent() const { return m_public_exponent; }