Fix for CVE-2015-1789.
X509_cmp_time does not properly check the length of the ASN1_TIME string
and can read a few bytes out of bounds. In addition, X509_cmp_time
accepts an arbitrary number of fractional seconds in the time string.
An attacker can use this to craft malformed certificates and CRLs of
various sizes and potentially cause a segmentation fault, resulting in a
DoS on applications that verify certificates or CRLs. TLS clients that
verify CRLs are affected. TLS clients and servers with client
authentication enabled may be affected if they use custom verification
callbacks.
This change cherry-picks the following changes from BoringSSL:
d87021d2 – Fix length checks in X509_cmp_time to avoid out-of-bounds reads.
Change-Id: Ia7d0c5d889f61a3c4be6ea79a5ab41f67bc3c65c
1 file changed