mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libfreerdp-crypto: add robustness checks for VerifyX509Certificate

Browse Source
This commit is contained in:
Marc-André Moreau 2013-11-25 12:08:58 -05:00
parent 128fb72ec6
commit 4987f2b0e1
1 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
libfreerdp/crypto/tls.c
View File

@ -596,14 +596,33 @@ BOOL tls_verify_certificate(rdpTls* tls, CryptoCert cert, char* hostname)
*/ */
bio = BIO_new(BIO_s_mem()); bio = BIO_new(BIO_s_mem());
if (!bio)
{
fprintf(stderr, "tls_verify_certificate: BIO_new() failure\n");
return FALSE;
}
status = PEM_write_bio_X509(bio, cert->px509); status = PEM_write_bio_X509(bio, cert->px509);
if (status < 0)
{
fprintf(stderr, "tls_verify_certificate: PEM_write_bio_X509 failure: %d\n", status);
return FALSE;
}
offset = 0; offset = 0;
length = 2048; length = 2048;
pemCert = (BYTE*) malloc(length + 1); pemCert = (BYTE*) malloc(length + 1);
status = BIO_read(bio, pemCert, length); status = BIO_read(bio, pemCert, length);
if (status < 0)
{
fprintf(stderr, "tls_verify_certificate: failed to read certificate\n");
return FALSE;
}
offset += status; offset += status;
while (offset >= length) while (offset >= length)
@ -619,17 +638,27 @@ BOOL tls_verify_certificate(rdpTls* tls, CryptoCert cert, char* hostname)
offset += status; offset += status;
} }
if (status < 0)
{
fprintf(stderr, "tls_verify_certificate: failed to read certificate\n");
return FALSE;
}
length = offset; length = offset;
pemCert[length] = '\0'; pemCert[length] = '\0';
status = -1; status = -1;
if (instance->VerifyX509Certificate) if (instance->VerifyX509Certificate)
{ {
status = instance->VerifyX509Certificate(instance, pemCert, length, 0); status = instance->VerifyX509Certificate(instance, pemCert, length, 0);
} }
fprintf(stderr, "VerifyX509Certificate: (length = %d) status: %d\n%s\n",
length, status, pemCert);
free(pemCert); free(pemCert);
BIO_free(bio);
return (status < 0) ? FALSE : TRUE; return (status < 0) ? FALSE : TRUE;
} }