From ad943c8df0520cc314ac5c875306ccf01c0747c9 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Mon, 9 Mar 2015 23:11:45 +0000 Subject: Fix ASN1_TYPE_cmp Fix segmentation violation when ASN1_TYPE_cmp is passed a boolean type. This can be triggered during certificate verification so could be a DoS attack against a client or a server enabling client authentication. CVE-2015-0286 Reviewed-by: Richard Levitte --- crypto/asn1/a_type.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/asn1/a_type.c b/crypto/asn1/a_type.c index a45d2f9..7c4fa4d 100644 --- a/crypto/asn1/a_type.c +++ b/crypto/asn1/a_type.c @@ -124,6 +124,9 @@ int ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b) case V_ASN1_OBJECT: result = OBJ_cmp(a->value.object, b->value.object); break; + case V_ASN1_BOOLEAN: + result = a->value.boolean - b->value.boolean; + break; case V_ASN1_NULL: result = 0; /* They do not have content. */ break; -- cgit v1.1