Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2026-01-06 14:38:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Potential buffer overwrite in pem_write_buffer() fixed

Browse source 
Length indication when given a too small buffer was off.
Added regression test in test_suite_pem to detect this.
This commit is contained in:
Paul Bakker 2014-04-11 13:28:43 +02:00
parent d6ad8e949b
commit 1630058dde
7 changed files with 74 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tests/suites/main_test.function
View file

@ -1,6 +1,14 @@
#include <stdio.h>
#include <string.h>
#if defined(POLARSSL_PLATFORM_C)
#include "polarssl/platform.h"
#else
#define polarssl_printf printf
#define polarssl_malloc malloc
#define polarssl_free free
#endif
static int test_errors = 0;
SUITE_PRE_DEP

17
tests/suites/test_suite_pem.data Normal file
View file

@ -0,0 +1,17 @@
Standard PEM write
pem_write_buffer:"-----START TEST-----\n":"-----END TEST-----\n":"000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F":"-----START TEST-----\nAAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8=\n-----END TEST-----\n"
PEM write (zero data)
pem_write_buffer:"-----START TEST-----\n":"-----END TEST-----\n":"":"-----START TEST-----\n-----END TEST-----\n"
PEM write (one byte)
pem_write_buffer:"-----START TEST-----\n":"-----END TEST-----\n":"00":"-----START TEST-----\nAA==\n-----END TEST-----\n"
PEM write (more than line size)
pem_write_buffer:"-----START TEST-----\n":"-----END TEST-----\n":"000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F":"-----START TEST-----\nAAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\nAAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8=\n-----END TEST-----\n"
PEM write (exactly two lines)
pem_write_buffer:"-----START TEST-----\n":"-----END TEST-----\n":"000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F":"-----START TEST-----\nAAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\nAAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n-----END TEST-----\n"
PEM write (exactly two lines + 1)
pem_write_buffer:"-----START TEST-----\n":"-----END TEST-----\n":"000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F00":"-----START TEST-----\nAAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\nAAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\nAA==\n-----END TEST-----\n"

38
tests/suites/test_suite_pem.function Normal file
View file

@ -0,0 +1,38 @@
/* BEGIN_HEADER */
#include <polarssl/base64.h>
#include <polarssl/pem.h>
/* END_HEADER */
/* BEGIN_DEPENDENCIES
* depends_on:POLARSSL_PEM_WRITE_C
* END_DEPENDENCIES
*/
/* BEGIN_CASE */
void pem_write_buffer( char *start, char *end, char *buf_str, char *result_str )
{
unsigned char buf[5000];
unsigned char *check_buf;
int ret;
size_t buf_len, olen = 0, olen2 = 0;
memset( buf, 0, sizeof( buf ) );
buf_len = unhexify( buf, buf_str );
ret = pem_write_buffer( start, end, buf, buf_len, NULL, 0, &olen );
TEST_ASSERT( ret == POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL );
check_buf = (unsigned char *) polarssl_malloc( olen );
TEST_ASSERT( check_buf != NULL );
memset( check_buf, 0, olen );
ret = pem_write_buffer( start, end, buf, buf_len, check_buf, olen, &olen2 );
TEST_ASSERT( olen2 <= olen );
TEST_ASSERT( olen > strlen( (char*) result_str ) );
TEST_ASSERT( ret == 0 );
TEST_ASSERT( strncmp( (char *) check_buf, (char *) result_str, olen ) == 0 );
polarssl_free( check_buf );
}
/* END_CASE */