Prevent signed integer overflow in CSR parsing
Modify the function mbedtls_x509_csr_parse_der() so that it checks the
parsed CSR version integer before it increments the value. This prevents
a potential signed integer overflow, as these have undefined behaviour
in the C standard.
diff --git a/ChangeLog b/ChangeLog
index 62ef470..73da67a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,13 @@
encoded X509 CRLs. The overflow would enable maliciously constructed CRLs
to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
KNOX Security, Samsung Research America
+ * Fix a potential integer overflow in the version verification for DER
+ encoded X509 certificates. The overflow would enable maliciously
+ constructed certificates to bypass the certificate verification check.
+ * Fix potential integer overflow in the version verification for DER
+ encoded X509 CSRs. The overflow would enable maliciously constructed CSRs
+ to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
+ KNOX Security, Samsung Research America
= mbed TLS 2.1.8 branch released 2017-06-21
@@ -131,9 +138,6 @@
digits. Found and fixed by Guido Vranken.
* Fix unlisted DES configuration dependency in some pkparse test cases. Found
by inestlerode. #555
- * Fix a potential integer overflow in the version verification for DER
- encoded X509 certificates. The overflow would enable maliciously
- constructed certificates to bypass the certificate verification check.
= mbed TLS 2.1.6 branch released 2016-10-17