From b8eed2b9b93a98af34d14856def66ee4a062a1f9 Mon Sep 17 00:00:00 2001 From: Kazuki Yamaguchi Date: Mon, 28 Jun 2021 17:48:47 +0900 Subject: pkey: use RSTRING_LENINT() instead of casting to int RSTRING_LENINT() checks the range of int and raises an exception as necessary. OpenSSL::PKey::EC#dsa_verify_asn1 currently does not do this, and giving a too big string to it can trigger a surprising behavior: ec.dsa_verify_asn1(digest, signature) #=> true ec.dsa_verify_asn1(digest, signature + "x" * 2**32) #=> true Reference: https://hackerone.com/reports/1246050 --- ext/openssl/ossl_pkey_ec.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'ext/openssl/ossl_pkey_ec.c') diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c index 8bb61124..b47678dc 100644 --- a/ext/openssl/ossl_pkey_ec.c +++ b/ext/openssl/ossl_pkey_ec.c @@ -653,15 +653,15 @@ static VALUE ossl_ec_key_dsa_verify_asn1(VALUE self, VALUE data, VALUE sig) StringValue(data); StringValue(sig); - switch (ECDSA_verify(0, (unsigned char *) RSTRING_PTR(data), RSTRING_LENINT(data), (unsigned char *) RSTRING_PTR(sig), (int)RSTRING_LEN(sig), ec)) { - case 1: return Qtrue; - case 0: return Qfalse; - default: break; + switch (ECDSA_verify(0, (unsigned char *)RSTRING_PTR(data), RSTRING_LENINT(data), + (unsigned char *)RSTRING_PTR(sig), RSTRING_LENINT(sig), ec)) { + case 1: + return Qtrue; + case 0: + return Qfalse; + default: + ossl_raise(eECError, "ECDSA_verify"); } - - ossl_raise(eECError, "ECDSA_verify"); - - UNREACHABLE; } /* -- cgit v1.2.3