|
| 1 | +From eeee3cbd4d682095ed431052f00403004596373e Mon Sep 17 00:00:00 2001 |
| 2 | +From: Bob Beck <beck@openssl.org> |
| 3 | +Date: Wed, 7 Jan 2026 11:29:48 -0700 |
| 4 | +Subject: [PATCH] Ensure ASN1 types are checked before use. |
| 5 | + |
| 6 | +Some of these were fixed by LibreSSL in commit https://github.com/openbsd/src/commit/aa1f637d454961d22117b4353f98253e984b3ba8 |
| 7 | +this fix includes the other fixes in that commit, as well as fixes for others found by a scan |
| 8 | +for a similar unvalidated access paradigm in the tree. |
| 9 | + |
| 10 | +Reviewed-by: Kurt Roeckx <kurt@roeckx.be> |
| 11 | +Reviewed-by: Shane Lontis <shane.lontis@oracle.com> |
| 12 | +Reviewed-by: Tomas Mraz <tomas@openssl.org> |
| 13 | +(Merged from https://github.com/openssl/openssl/pull/29582) |
| 14 | + |
| 15 | +Fixes CVE-2026-22796, CVE-2026-22795 |
| 16 | +--- |
| 17 | + apps/s_client.c | 3 ++- |
| 18 | + crypto/pkcs12/p12_kiss.c | 10 ++++++++-- |
| 19 | + crypto/pkcs7/pk7_doit.c | 2 ++ |
| 20 | + 3 files changed, 12 insertions(+), 3 deletions(-) |
| 21 | + |
| 22 | +diff --git a/apps/s_client.c b/apps/s_client.c |
| 23 | +index c5b7384a290a4..1f52cf378fbbc 100644 |
| 24 | +--- a/apps/s_client.c |
| 25 | ++++ b/apps/s_client.c |
| 26 | +@@ -2832,8 +2832,9 @@ int s_client_main(int argc, char **argv) |
| 27 | + goto end; |
| 28 | + } |
| 29 | + atyp = ASN1_generate_nconf(genstr, cnf); |
| 30 | +- if (atyp == NULL) { |
| 31 | ++ if (atyp == NULL || atyp->type != V_ASN1_SEQUENCE) { |
| 32 | + NCONF_free(cnf); |
| 33 | ++ ASN1_TYPE_free(atyp); |
| 34 | + BIO_printf(bio_err, "ASN1_generate_nconf failed\n"); |
| 35 | + goto end; |
| 36 | + } |
| 37 | +diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c |
| 38 | +index 10b581612dbb2..d0236e34fe9df 100644 |
| 39 | +--- a/crypto/pkcs12/p12_kiss.c |
| 40 | ++++ b/crypto/pkcs12/p12_kiss.c |
| 41 | +@@ -196,11 +196,17 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, |
| 42 | + ASN1_BMPSTRING *fname = NULL; |
| 43 | + ASN1_OCTET_STRING *lkid = NULL; |
| 44 | + |
| 45 | +- if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_friendlyName))) |
| 46 | ++ if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_friendlyName))) { |
| 47 | ++ if (attrib->type != V_ASN1_BMPSTRING) |
| 48 | ++ return 0; |
| 49 | + fname = attrib->value.bmpstring; |
| 50 | ++ } |
| 51 | + |
| 52 | +- if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID))) |
| 53 | ++ if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID))) { |
| 54 | ++ if (attrib->type != V_ASN1_OCTET_STRING) |
| 55 | ++ return 0; |
| 56 | + lkid = attrib->value.octet_string; |
| 57 | ++ } |
| 58 | + |
| 59 | + switch (PKCS12_SAFEBAG_get_nid(bag)) { |
| 60 | + case NID_keyBag: |
| 61 | +diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c |
| 62 | +index 74f863af8fa52..6353fec47c068 100644 |
| 63 | +--- a/crypto/pkcs7/pk7_doit.c |
| 64 | ++++ b/crypto/pkcs7/pk7_doit.c |
| 65 | +@@ -1178,6 +1178,8 @@ ASN1_OCTET_STRING *PKCS7_digest_from_attributes(STACK_OF(X509_ATTRIBUTE) *sk) |
| 66 | + ASN1_TYPE *astype; |
| 67 | + if ((astype = get_attribute(sk, NID_pkcs9_messageDigest)) == NULL) |
| 68 | + return NULL; |
| 69 | ++ if (astype->type != V_ASN1_OCTET_STRING) |
| 70 | ++ return NULL; |
| 71 | + return astype->value.octet_string; |
| 72 | + } |
| 73 | + |
0 commit comments