summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorTimur Pocheptsov <timur.pocheptsov@qt.io>2020-03-18 19:54:33 +0100
committerTimur Pocheptsov <timur.pocheptsov@qt.io>2020-03-19 14:48:08 +0100
commitad68ecf1d967f8e60c19c28a2bc23daf15389076 (patch)
tree824516fb2d592e4c8bd2c621db82a89d6fba4086 /src
parent05dd80871c870a564a46e388d7fd124a58fc970d (diff)
q_getTimeFromASN1: fix invalid access
No sanitizer is needed, just looking at the code is enough. It was wrong. Change-Id: I9df417c137d6b3361c3161865e099a8be40860de Reviewed-by: Lars Knoll <lars.knoll@qt.io> Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
Diffstat (limited to 'src')
-rw-r--r--src/network/ssl/qsslsocket_openssl_symbols.cpp18
1 files changed, 17 insertions, 1 deletions
diff --git a/src/network/ssl/qsslsocket_openssl_symbols.cpp b/src/network/ssl/qsslsocket_openssl_symbols.cpp
index 26336edd3d..85029a6ff3 100644
--- a/src/network/ssl/qsslsocket_openssl_symbols.cpp
+++ b/src/network/ssl/qsslsocket_openssl_symbols.cpp
@@ -1428,6 +1428,9 @@ QDateTime q_getTimeFromASN1(const ASN1_TIME *aTime)
{
size_t lTimeLength = aTime->length;
char *pString = (char *) aTime->data;
+ auto isValidPointer = [pString, lTimeLength](const char *const probe){
+ return size_t(probe - pString) < lTimeLength;
+ };
if (aTime->type == V_ASN1_UTCTIME) {
@@ -1446,12 +1449,21 @@ QDateTime q_getTimeFromASN1(const ASN1_TIME *aTime)
*pBuffer++ = '0';
} else {
*pBuffer++ = *pString++;
+ if (!isValidPointer(pString)) // Nah.
+ return {};
*pBuffer++ = *pString++;
+ if (!isValidPointer(pString)) // Nah.
+ return {};
// Skip any fractional seconds...
if (*pString == '.') {
pString++;
- while ((*pString >= '0') && (*pString <= '9'))
+ if (!isValidPointer(pString)) // Oh no, cannot dereference (see below).
+ return {};
+ while ((*pString >= '0') && (*pString <= '9')) {
pString++;
+ if (!isValidPointer(pString)) // No and no.
+ return {};
+ }
}
}
@@ -1465,6 +1477,10 @@ QDateTime q_getTimeFromASN1(const ASN1_TIME *aTime)
if ((*pString != '+') && (*pString != '-'))
return QDateTime();
+ if (!isValidPointer(pString + 4)) {
+ // What kind of input parameters we were provided with? To hell with them!
+ return {};
+ }
lSecondsFromUCT = ((pString[1] - '0') * 10 + (pString[2] - '0')) * 60;
lSecondsFromUCT += (pString[3] - '0') * 10 + (pString[4] - '0');
lSecondsFromUCT *= 60;