Fixed buffer overflow in private key decoding (wrong buffer length used in size check).

[BearSSL] / src / x509 / x509_decoder.c

diff --git a/src/x509/x509_decoder.c b/src/x509/x509_decoder.c
index 64a7996..8dd970f 100644 (file)
--- a/src/x509/x509_decoder.c
+++ b/src/x509/x509_decoder.c
@@ -58,7 +58,7 @@ t0_parse7E_signed(const unsigned char **p)
 #define T0_INT4(x)       T0_VBYTE(x, 21), T0_VBYTE(x, 14), T0_VBYTE(x, 7), T0_FBYTE(x, 0)
 #define T0_INT5(x)       T0_SBYTE(x), T0_VBYTE(x, 21), T0_VBYTE(x, 14), T0_VBYTE(x, 7), T0_FBYTE(x, 0)
 
-static const uint8_t t0_datablock[];
+/* static const unsigned char t0_datablock[]; */
 
 
 void br_x509_decoder_init_main(void *t0ctx);
@@ -75,7 +75,7 @@ void br_x509_decoder_run(void *t0ctx);
 
 #include "inner.h"
 
-#define CTX   ((br_x509_decoder_context *)((unsigned char *)t0ctx - offsetof(br_x509_decoder_context, cpu)))
+#define CTX   ((br_x509_decoder_context *)(void *)((unsigned char *)t0ctx - offsetof(br_x509_decoder_context, cpu)))
 #define CONTEXT_NAME   br_x509_decoder_context
 
 /* see bearssl_x509.h */
@@ -110,7 +110,7 @@ br_x509_decoder_push(br_x509_decoder_context *ctx,
 
 
 
-static const uint8_t t0_datablock[] = {
+static const unsigned char t0_datablock[] = {
        0x00, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x09,
        0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05, 0x09, 0x2A, 0x86,
        0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0E, 0x09, 0x2A, 0x86, 0x48, 0x86,
@@ -129,7 +129,7 @@ static const uint8_t t0_datablock[] = {
        0x29, 0xFF, 0x03, 0x55, 0x1D, 0x13
 };
 
-static const uint8_t t0_codeblock[] = {
+static const unsigned char t0_codeblock[] = {
        0x00, 0x01, 0x00, 0x10, 0x00, 0x00, 0x01, 0x00, 0x11, 0x00, 0x00, 0x01,
        0x01, 0x09, 0x00, 0x00, 0x01, 0x01, 0x0A, 0x00, 0x00, 0x1A, 0x1A, 0x00,
        0x00, 0x01, T0_INT1(BR_ERR_X509_BAD_BOOLEAN), 0x00, 0x00, 0x01,
@@ -743,7 +743,7 @@ br_x509_decoder_run(void *t0ctx)
                                /* set32 */
 
        uint32_t addr = T0_POP();
-       *(uint32_t *)((unsigned char *)CTX + addr) = T0_POP();
+       *(uint32_t *)(void *)((unsigned char *)CTX + addr) = T0_POP();
 
                                }
                                break;