Skip to content

Fix unchecked i2d_PrivateKey() return value causing size_t overflow and abort#619

Open
metsw24-max wants to merge 2 commits intoapache:trunkfrom
metsw24-max:mod_ssl-i2d-privatekey-overflow
Open

Fix unchecked i2d_PrivateKey() return value causing size_t overflow and abort#619
metsw24-max wants to merge 2 commits intoapache:trunkfrom
metsw24-max:mod_ssl-i2d-privatekey-overflow

Conversation

@metsw24-max
Copy link

The return value of i2d_PrivateKey() in ssl_asn1_table_set() is not validated before being assigned to an apr_size_t.

i2d_PrivateKey() returns an int and may return <= 0 on failure. This value is directly cast to apr_size_t, which can result in a large unsigned value when negative. This leads to excessive memory allocation attempts via ap_malloc()/ap_realloc(), causing the server to abort.

This patch introduces proper validation of the return value before casting, preventing invalid allocations.

Additionally, the caller in ssl_engine_pphrase.c is updated to handle NULL return values from ssl_asn1_table_set() to avoid NULL dereference.

Reproduction:

  • Force i2d_PrivateKey() to return -1
  • Apache attempts to allocate a huge buffer and aborts

After fix:

  • Failure is handled gracefully
  • No crash occurs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant