From 347727b12271302d10bf824b29bde86c3f130d5c Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Mon, 24 Aug 2026 11:47:34 +0530 Subject: [PATCH] fix(mbedtls): validate cert header extent before reading it in bundle check esp_crt_check_bundle() read the 4-byte certificate header (name_len, key_len) via esp_crt_get_len() after only checking that the cert's start offset lies inside the bundle, so a crafted bundle whose first or last certificate starts within the final 3 bytes caused a transient out-of-bounds read of up to 3 bytes before the extent check rejected it. Require the whole header to lie inside the bundle before reading it. --- components/mbedtls/esp_crt_bundle/esp_crt_bundle.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c b/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c index a29b0226b4a..a285af6ee03 100644 --- a/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c +++ b/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c @@ -315,6 +315,9 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t // Check all offsets for consistency with certificate data for (uint32_t i = 0; i < num_certs - 1; ++i) { const uint32_t off = esp_crt_get_cert_offset(x509_bundle, i); + if (unlikely((uint64_t)off + CRT_HEADER_SIZE > bundle_size)) { + return false; + } cert_t cert = x509_bundle + off; // The next offset in the list must point to right after the current cert const uint32_t expected_next_offset = off + esp_crt_get_len(cert); @@ -328,7 +331,7 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t // The loop above stops at num_certs - 1, so the final certificate's extent is never // validated; check it explicitly so its key data cannot run past the bundle (CWE-125). const uint32_t last_off = esp_crt_get_cert_offset(x509_bundle, num_certs - 1); - if (unlikely(last_off >= bundle_size)) { + if (unlikely((uint64_t)last_off + CRT_HEADER_SIZE > bundle_size)) { return false; } const uint32_t last_len = esp_crt_get_len(x509_bundle + last_off);