Prevent signed integer overflow in CSR parsing
Modify the function x509_csr_parse_der() so that it checks the parsed
CSR version integer before it increments the value. This prevents a
potential signed integer overflow, as these have undefined behaviour in
the C standard.
diff --git a/library/x509_csr.c b/library/x509_csr.c
index 9bdfe88..b3c8f29 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -169,14 +169,14 @@
return( ret );
}
- csr->version++;
-
- if( csr->version != 1 )
+ if( csr->version != 0 )
{
x509_csr_free( csr );
return( POLARSSL_ERR_X509_UNKNOWN_VERSION );
}
+ csr->version++;
+
/*
* subject Name
*/