projects / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 015b172) | patch
Fix leak with ASN.1 combine.
authorDr. Stephen Henson <steve@openssl.org>
Tue, 10 Nov 2015 19:03:07 +0000 (19:03 +0000)
committerRichard Levitte <richard@levitte.org>
Wed, 2 Dec 2015 20:40:11 +0000 (21:40 +0100)
commitcf432b3b1bd7caa22943b41b94ec2472ae497dc6
treee8c4bacd99748a0ce59f660643a494219ec32839tree | snapshot
parent015b17257855e31003eb29a70280764c3c822710commit | diff
Fix leak with ASN.1 combine.

When parsing a combined structure pass a flag to the decode routine
so on error a pointer to the parent structure is not zeroed as
this will leak any additional components in the parent.

This can leak memory in any application parsing PKCS#7 or CMS structures.

CVE-2015-3195.

Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using
libFuzzer.

PR#4131

Reviewed-by: Richard Levitte <levitte@openssl.org>
crypto/asn1/tasn_dec.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.