From 918430ba80d94ec8f05383b43b1872b1ebb13e1a Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 18 Aug 2021 14:02:40 +0100 Subject: [PATCH] Fix printing of PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings ASN.1 strings may not be NUL terminated. Don't assume they are. CVE-2021-3712 Reviewed-by: Viktor Dukhovni Reviewed-by: Paul Dale Reviewed-by: David Benjamin --- crypto/x509/v3_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/x509/v3_pci.c b/crypto/x509/v3_pci.c index 7a7c91f776..a931e01a9c 100644 --- a/crypto/x509/v3_pci.c +++ b/crypto/x509/v3_pci.c @@ -76,7 +76,8 @@ static int i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci, BIO_printf(out, "%*sPolicy Language: ", indent, ""); i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage); if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data) - BIO_printf(out, "\n%*sPolicy Text: %s", indent, "", + BIO_printf(out, "\n%*sPolicy Text: %.*s", indent, "", + pci->proxyPolicy->policy->length, pci->proxyPolicy->policy->data); return 1; }