aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorrhe <rhe@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2016-05-19 04:12:57 +0000
committerrhe <rhe@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2016-05-19 04:12:57 +0000
commit2ff9180946c7fe4c98aebabb33fd85fefef9f0af (patch)
tree7240c70556e796ae63346f2a01570e449227f30c
parent1d5fe7906cfad11987a9291ae5e1f587d7d07f37 (diff)
downloadruby-2ff9180946c7fe4c98aebabb33fd85fefef9f0af.tar.gz
openssl: check argument type in OpenSSL::X509::Attribute#value=
* ext/openssl/ossl_x509attr.c (ossl_x509attr_set_value): check that the argument is an OpenSSL::ASN1::Data before converting to ASN1_TYPE. This fixes SEGV on OpenSSL::X509::Attribute#value=(non-asn1-value). * test/openssl/test_x509attr.rb: add tests for OpenSSL::X509::Attribute. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55071 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--ChangeLog8
-rw-r--r--ext/openssl/ossl_x509attr.c1
-rw-r--r--test/openssl/test_x509attr.rb56
3 files changed, 65 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index f70d2191db..c163123735 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Thu May 19 13:11:35 2016 Kazuki Yamaguchi <k@rhe.jp>
+
+ * ext/openssl/ossl_x509attr.c (ossl_x509attr_set_value): check that the
+ argument is an OpenSSL::ASN1::Data before converting to ASN1_TYPE.
+ This fixes SEGV on OpenSSL::X509::Attribute#value=(non-asn1-value).
+
+ * test/openssl/test_x509attr.rb: add tests for OpenSSL::X509::Attribute.
+
Thu May 19 12:10:10 2016 Nobuyoshi Nakada <nobu@ruby-lang.org>
* re.c (rb_reg_match_m_p): fix match against empty string.
diff --git a/ext/openssl/ossl_x509attr.c b/ext/openssl/ossl_x509attr.c
index d0f41c6bb8..be5f2dcf88 100644
--- a/ext/openssl/ossl_x509attr.c
+++ b/ext/openssl/ossl_x509attr.c
@@ -196,6 +196,7 @@ ossl_x509attr_set_value(VALUE self, VALUE value)
X509_ATTRIBUTE *attr;
ASN1_TYPE *a1type;
+ OSSL_Check_Kind(value, cASN1Data);
if(!(a1type = ossl_asn1_get_asn1type(value)))
ossl_raise(eASN1Error, "could not get ASN1_TYPE");
if(ASN1_TYPE_get(a1type) == V_ASN1_SEQUENCE){
diff --git a/test/openssl/test_x509attr.rb b/test/openssl/test_x509attr.rb
new file mode 100644
index 0000000000..1ba8a87536
--- /dev/null
+++ b/test/openssl/test_x509attr.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: false
+require_relative "utils"
+
+if defined?(OpenSSL::TestUtils)
+
+class OpenSSL::TestX509Attribute < OpenSSL::TestCase
+ def test_new
+ ef = OpenSSL::X509::ExtensionFactory.new
+ val = OpenSSL::ASN1::Set.new([OpenSSL::ASN1::Sequence.new([
+ ef.create_extension("keyUsage", "keyCertSign", true)
+ ])])
+ attr = OpenSSL::X509::Attribute.new("extReq", val)
+ assert_equal("extReq", attr.oid)
+ assert_equal(val.to_der, attr.value.to_der)
+ end
+
+ def test_from_der
+ # oid: challengePassword, values: Set[UTF8String<"abc123">]
+ test_der = "\x30\x15\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x09\x07\x31\x08" \
+ "\x0c\x06\x61\x62\x63\x31\x32\x33".b
+ attr = OpenSSL::X509::Attribute.new(test_der)
+ assert_equal(test_der, attr.to_der)
+ assert_equal("challengePassword", attr.oid)
+ assert_equal("abc123", attr.value.value[0].value)
+ end
+
+ def test_to_der
+ ef = OpenSSL::X509::ExtensionFactory.new
+ val = OpenSSL::ASN1::Set.new([OpenSSL::ASN1::Sequence.new([
+ ef.create_extension("keyUsage", "keyCertSign", true)
+ ])])
+ attr = OpenSSL::X509::Attribute.new("extReq", val)
+ expected = OpenSSL::ASN1::Sequence.new([
+ OpenSSL::ASN1::ObjectId.new("extReq"),
+ val
+ ])
+ assert_equal(expected.to_der, attr.to_der)
+ end
+
+ def test_invalid_value
+ # should not change the original value
+ test_der = "\x30\x15\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x09\x07\x31\x08" \
+ "\x0c\x06\x61\x62\x63\x31\x32\x33".b
+ attr = OpenSSL::X509::Attribute.new(test_der)
+ assert_raise(TypeError) {
+ attr.value = "1234"
+ }
+ assert_equal(test_der, attr.to_der)
+ assert_raise(OpenSSL::X509::AttributeError) {
+ attr.oid = "abc123"
+ }
+ assert_equal(test_der, attr.to_der)
+ end
+end
+
+end