Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/crt_bundle_cert_header_oob_v6.0' into 'release/v6.0'

Browse Source 
Validate cert header extent before reading it in bundle check (v6.0)

See merge request espressif/esp-idf!51998
This commit is contained in:
Mahavir Jain
2026-09-03 13:44:33 +05:30
parent cb7bc8f7d8 710ce291ac
commit b3c5d5266a
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mbedtls/esp_crt_bundle/esp_crt_bundle.c
+4 -1
View File
@@ -438,6 +438,9 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t
// Check all offsets for consistency with certificate data // Check all offsets for consistency with certificate data
for (uint32_t i = 0; i < num_certs - 1; ++i) { for (uint32_t i = 0; i < num_certs - 1; ++i) {
const uint32_t off = offsets[i]; const uint32_t off = offsets[i];
if (unlikely((uint64_t)off + CRT_HEADER_SIZE > bundle_size)) {
return false;
}
cert_t cert = x509_bundle + off; cert_t cert = x509_bundle + off;
// The next offset in the list must point to right after the current cert // The next offset in the list must point to right after the current cert
const uint32_t expected_next_offset = off + esp_crt_get_len(cert); const uint32_t expected_next_offset = off + esp_crt_get_len(cert);
@@ -450,7 +453,7 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t
// The loop above stops at num_certs - 1, so the final certificate's extent is never // The loop above stops at num_certs - 1, so the final certificate's extent is never
// validated; check it explicitly so its key data cannot run past the bundle (CWE-125). // validated; check it explicitly so its key data cannot run past the bundle (CWE-125).
const uint32_t last_off = offsets[num_certs - 1]; const uint32_t last_off = offsets[num_certs - 1];
if (unlikely(last_off >= bundle_size)) { if (unlikely((uint64_t)last_off + CRT_HEADER_SIZE > bundle_size)) {
return false; return false;
} }
const uint32_t last_len = esp_crt_get_len(x509_bundle + last_off); const uint32_t last_len = esp_crt_get_len(x509_bundle + last_off);