You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2022/02/21 07:16:17 UTC
[Bug 65902] New: modules/ssl/ssl_engine_vars.c: Add check after calling ASN1_STRING_new
https://bz.apache.org/bugzilla/show_bug.cgi?id=65902
Bug ID: 65902
Summary: modules/ssl/ssl_engine_vars.c: Add check after calling
ASN1_STRING_new
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: mod_ssl
Assignee: bugs@httpd.apache.org
Reporter: jiasheng@iscas.ac.cn
Target Milestone: ---
Created attachment 38205
--> https://bz.apache.org/bugzilla/attachment.cgi?id=38205&action=edit
0001-modules-ssl-ssl_engine_vars-Add-check-after-calling-ASN1_STRING_new
As the potential failure of the memory allocation,
the 'ret' could NULL pointer if fails.
And I have checked the OPENSSL docs of the 'd2i_DISPLAYTEXT'
(Link: https://www.openssl.org/docs/man3.0/man3/d2i_DISPLAYTEXT.html),
it could accept NULL pointer as a valid parameter and return success.
Then 'ret' will be dereferenced in ASN1_STRING_print_ex().
Therefore, it should be better to check ASN1_STRING_new() and return
error if fails.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 65902] modules/ssl/ssl_engine_vars.c: Add check after calling ASN1_STRING_new
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65902
--- Comment #2 from Giovanni Bechis <gi...@paclan.it> ---
Committed in r1898368.
Thanks
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 65902] modules/ssl/ssl_engine_vars.c: Add check after calling ASN1_STRING_new
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65902
Giovanni Bechis <gi...@paclan.it> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
--- Comment #1 from Giovanni Bechis <gi...@paclan.it> ---
Committed in r1898367.
Thanks
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org