commit a37f52436f9aa4b9292878b72f3ff1480e2606c3
author Christian Heimes <christian@python.org> Tue Jan 15 23:47:42 2019 +0100
committer Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Tue Jan 15 14:47:42 2019 -0800
tree 241263055db201418a7288a883eefd783ff59364
parent c9f872b0bdce5888f1879fa74e098bf4a05430c5

bpo-35746: Fix segfault in ssl's cert parser (GH-11569)



Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue35746

Modules/_ssl.c

diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 4e3352d..0e720e2 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -1515,6 +1515,10 @@
         STACK_OF(GENERAL_NAME) *gns;
 
         dp = sk_DIST_POINT_value(dps, i);
+        if (dp->distpoint == NULL) {
+            /* Ignore empty DP value, CVE-2019-5010 */
+            continue;
+        }
         gns = dp->distpoint->name.fullname;
 
         for (j=0; j < sk_GENERAL_NAME_num(gns); j++) {