tor/bug33119 at 31a6a101a0c4cbe739a55069bf29a0f0615e5aa8 - tor - RingTools

mirrors/tor

mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-19 18:00:33 +01:00

Alexander Færøy b46984e97e Fix out-of-bound memory read in tor_tls_cert_matches_key() for NSS.

This patch fixes an out-of-bound memory read in
`tor_tls_cert_matches_key()` when Tor is compiled to use Mozilla's NSS
instead of OpenSSL.

The NSS library stores some length fields in bits instead of bytes, but
the comparison function found in `SECITEM_ItemsAreEqual()` needs the
length to be encoded in bytes. This means that for a 140-byte,
DER-encoded, SubjectPublicKeyInfo struct (with a 1024-bit RSA public key
in it), we would ask `SECITEM_ItemsAreEqual()` to compare the first 1120
bytes instead of 140 (140bytes * 8bits = 1120bits).

This patch fixes the issue by converting from bits to bytes before
calling `SECITEM_ItemsAreEqual()` and convert the `len`-fields back to
bits before we leave the function.

This patch is part of the fix for TROVE-2020-001.

See: https://bugs.torproject.org/33119

2020-07-06 16:19:16 -04:00

5 lines

234 B

Plaintext

Raw Blame History

   o Major bugfixes (NSS):
     - Fix out-of-bound memory access in `tor_tls_cert_matches_key()` when Tor is
       compiled with NSS support. Fixes bug 33119; bugfix on 0.3.5.1-alpha. This
       issue is also tracked as TROVE-2020-001.