diff options
| author | Gary Lin <glin@suse.com> | 2016-03-17 14:59:04 +0800 |
|---|---|---|
| committer | Peter Jones <pjones@redhat.com> | 2016-09-06 15:05:36 -0400 |
| commit | 0297aa3cf34ca3a95a6e95db7aff82020aefa0e5 (patch) | |
| tree | d2b0ff4c76d6df0960782c647a33cb30f7a2ef86 /Cryptlib/OpenSSL/crypto/bn/bn_print.c | |
| parent | 7b9281af14930040ec6cb333de2d64e0ff91cf3c (diff) | |
| download | efi-boot-shim-0297aa3cf34ca3a95a6e95db7aff82020aefa0e5.tar.gz efi-boot-shim-0297aa3cf34ca3a95a6e95db7aff82020aefa0e5.zip | |
Update openssl to 1.0.2g
Signed-off-by: Gary Lin <glin@suse.com>
Diffstat (limited to 'Cryptlib/OpenSSL/crypto/bn/bn_print.c')
| -rw-r--r-- | Cryptlib/OpenSSL/crypto/bn/bn_print.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/Cryptlib/OpenSSL/crypto/bn/bn_print.c b/Cryptlib/OpenSSL/crypto/bn/bn_print.c index ab10b957..bfa31efc 100644 --- a/Cryptlib/OpenSSL/crypto/bn/bn_print.c +++ b/Cryptlib/OpenSSL/crypto/bn/bn_print.c @@ -58,6 +58,7 @@ #include <stdio.h> #include <ctype.h> +#include <limits.h> #include "cryptlib.h" #include <openssl/buffer.h> #include "bn_lcl.h" @@ -189,7 +190,11 @@ int BN_hex2bn(BIGNUM **bn, const char *a) a++; } - for (i = 0; isxdigit((unsigned char)a[i]); i++) ; + for (i = 0; i <= (INT_MAX/4) && isxdigit((unsigned char)a[i]); i++) + continue; + + if (i > INT_MAX/4) + goto err; num = i + neg; if (bn == NULL) @@ -204,7 +209,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a) BN_zero(ret); } - /* i is the number of hex digests; */ + /* i is the number of hex digits */ if (bn_expand(ret, i * 4) == NULL) goto err; @@ -260,7 +265,11 @@ int BN_dec2bn(BIGNUM **bn, const char *a) a++; } - for (i = 0; isdigit((unsigned char)a[i]); i++) ; + for (i = 0; i <= (INT_MAX/4) && isdigit((unsigned char)a[i]); i++) + continue; + + if (i > INT_MAX/4) + goto err; num = i + neg; if (bn == NULL) @@ -278,7 +287,7 @@ int BN_dec2bn(BIGNUM **bn, const char *a) BN_zero(ret); } - /* i is the number of digests, a bit of an over expand; */ + /* i is the number of digits, a bit of an over expand */ if (bn_expand(ret, i * 4) == NULL) goto err; |