[patch] openconnect-8.06-get_cert_name-overflow.patch

openconnect-8.06-get_cert_name-overflow.patch (text/plain), 686 bytes, created by Sergei Trofimovich (RETIRED) on 2020-05-08 14:02:17 UTC

https://bugs.gentoo.org/721570

--- a/gnutls.c
+++ b/gnutls.c
@@ -556,9 +556,12 @@ static int count_x509_certificates(gnutls_datum_t *datum)
 
 static int get_cert_name(gnutls_x509_crt_t cert, char *name, size_t namelen)
 {
+	/* We assume 'nl' is updated only when gnutls_x509_crt_get_dn*()
+	 * fail. Avoid clobbering original 'namelen'. */
+	size_t nl = namelen;
 	if (gnutls_x509_crt_get_dn_by_oid(cert, GNUTLS_OID_X520_COMMON_NAME,
-					  0, 0, name, &namelen) &&
-	    gnutls_x509_crt_get_dn(cert, name, &namelen)) {
+					  0, 0, name, &nl) &&
+	    gnutls_x509_crt_get_dn(cert, name, &nl)) {
 		name[namelen-1] = 0;
 		snprintf(name, namelen-1, "<unknown>");
 		return -EINVAL;