diff options
| author | Jung-uk Kim <jkim@FreeBSD.org> | 2016-05-03 18:00:27 +0000 |
|---|---|---|
| committer | Jung-uk Kim <jkim@FreeBSD.org> | 2016-05-03 18:00:27 +0000 |
| commit | 57f1256b1a087adbdf8e5c080dd9ed7975de939a (patch) | |
| tree | 2dd85c58056a364765d9ae59d6a1774d41f88523 /crypto/pem/pvkfmt.c | |
| parent | 9aeed18ad799c20d3accf6e1535817538dc983f6 (diff) | |
Notes
Diffstat (limited to 'crypto/pem/pvkfmt.c')
| -rw-r--r-- | crypto/pem/pvkfmt.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/crypto/pem/pvkfmt.c b/crypto/pem/pvkfmt.c index 82d45273ed16e..61864468f6d49 100644 --- a/crypto/pem/pvkfmt.c +++ b/crypto/pem/pvkfmt.c @@ -131,6 +131,10 @@ static int read_lebn(const unsigned char **in, unsigned int nbyte, BIGNUM **r) # define MS_PVKMAGIC 0xb0b5f11eL /* Salt length for PVK files */ # define PVK_SALTLEN 0x10 +/* Maximum length in PVK header */ +# define PVK_MAX_KEYLEN 102400 +/* Maximum salt length */ +# define PVK_MAX_SALTLEN 10240 static EVP_PKEY *b2i_rsa(const unsigned char **in, unsigned int length, unsigned int bitlen, int ispub); @@ -644,6 +648,9 @@ static int do_PVK_header(const unsigned char **in, unsigned int length, *psaltlen = read_ledword(&p); *pkeylen = read_ledword(&p); + if (*pkeylen > PVK_MAX_KEYLEN || *psaltlen > PVK_MAX_SALTLEN) + return 0; + if (is_encrypted && !*psaltlen) { PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_INCONSISTENT_HEADER); return 0; |