Security fixes brought forward from 0.9.7.

[openssl.git] / crypto / asn1 / a_strex.c

diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c
index 7ddb7662f1e54f703781c03bae69b019f6dc6d5d..1def6c6549431b3631a6e240a4d3872ca7a1e150 100644 (file)
--- a/crypto/asn1/a_strex.c
+++ b/crypto/asn1/a_strex.c
@@ -63,6 +63,7 @@
 #include <openssl/asn1.h>
 
 #include "charmap.h"
+#include "cryptlib.h"
 
 /* ASN1_STRING_print_ex() and X509_NAME_print_ex().
  * Enhanced string and name printing routines handling
@@ -114,14 +115,17 @@ typedef int char_io(void *arg, const void *buf, int len);
 static int do_esc_char(unsigned long c, unsigned char flags, char *do_quotes, char_io *io_ch, void *arg)
 {
        unsigned char chflgs, chtmp;
-       char tmphex[11];
+       char tmphex[HEX_SIZE(long)+3];
+
+       if(c > 0xffffffffL)
+               return -1;
        if(c > 0xffff) {
-               BIO_snprintf(tmphex, 11, "\\W%08lX", c);
+               BIO_snprintf(tmphex, sizeof tmphex, "\\W%08lX", c);
                if(!io_ch(arg, tmphex, 10)) return -1;
                return 10;
        }
        if(c > 0xff) {
-               BIO_snprintf(tmphex, 11, "\\U%04lX", c);
+               BIO_snprintf(tmphex, sizeof tmphex, "\\U%04lX", c);
                if(!io_ch(arg, tmphex, 6)) return -1;
                return 6;
        }
@@ -195,7 +199,7 @@ static int do_buf(unsigned char *buf, int buflen,
                if(type & BUF_TYPE_CONVUTF8) {
                        unsigned char utfbuf[6];
                        int utflen;
-                       utflen = UTF8_putc(utfbuf, 6, c);
+                       utflen = UTF8_putc(utfbuf, sizeof utfbuf, c);
                        for(i = 0; i < utflen; i++) {
                                /* We don't need to worry about setting orflags correctly
                                 * because if utflen==1 its value will be correct anyway 
@@ -461,7 +465,7 @@ static int do_name_ex(char_io *io_ch, void *arg, X509_NAME *n,
                if(fn_opt != XN_FLAG_FN_NONE) {
                        int objlen, fld_len;
                        if((fn_opt == XN_FLAG_FN_OID) || (fn_nid==NID_undef) ) {
-                               OBJ_obj2txt(objtmp, 80, fn, 1);
+                               OBJ_obj2txt(objtmp, sizeof objtmp, fn, 1);
                                fld_len = 0; /* XXX: what should this be? */
                                objbuf = objtmp;
                        } else {