projects / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: fb4f467) | patch
Fix leak with ASN.1 combine.
authorDr. Stephen Henson <steve@openssl.org>
Tue, 10 Nov 2015 19:03:07 +0000 (19:03 +0000)
committerMatt Caswell <matt@openssl.org>
Thu, 3 Dec 2015 14:32:05 +0000 (14:32 +0000)
commitcc598f321fbac9c04da5766243ed55d55948637d
treebff3dba6e776736ce5576cb6dc6535601ad269dbtree | snapshot
parentfb4f46763fed3c600db21974577061b611b6fa46commit | diff
Fix leak with ASN.1 combine.

When parsing a combined structure pass a flag to the decode routine
so on error a pointer to the parent structure is not zeroed as
this will leak any additional components in the parent.

This can leak memory in any application parsing PKCS#7 or CMS structures.

CVE-2015-3195.

Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using
libFuzzer.

PR#4131

Reviewed-by: Richard Levitte <levitte@openssl.org>
crypto/asn1/tasn_dec.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.