823336 - Minor bug in security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Nickolai Zeldovich]

Attachment: Patch for pkix_pl_InfoAccess_ParseLocation()

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.40 Safari/537.17

Steps to reproduce:

I looked for various bugs in the Mozilla source code.


Actual results:

I found a minor issue in security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c, where it incorrectly parses LDAP locations (skips over a null pointer, which might lead to memory corruption).  I've attached a fairly obvious patch.

Comment 1

[Ryan Sleevi]

Comment on attachment 694167 [details] [diff] [review]
Patch for pkix_pl_InfoAccess_ParseLocation()

Note: This should not cause any security errors (unlike the description from the patch), because we still break out of the loop when *avaPtr == '\0' on the next iteration, and we then assign *(avaPtr++) = '\0'. So there's no off-the-end writes.

This does fix the error checking logic though, causing libpkix to properly return an error for invalidly encoded AVAs, so this works for me.

Matti, do you need someone to commit this for you?

Comment 2

[Matthias Versen [:Matti]]

Ryan: I'm not the patch submitter. I do only bug triage and requested a review for the submitter. I don't have cvs/hg access and it would be great if you could commit this patch.

Comment 3

[Ryan Sleevi]

Checking in security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c;
/cvsroot/mozilla/security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c,v  <--  pkix_pl_infoaccess.c
new revision: 1.14; previous revision: 1.13
done