From 8e5ca951257202089246fa37e93a99d210ee5ca2 Mon Sep 17 00:00:00 2001
From: Andrew Hamilton <adhamilt@gmail.com>
Date: Mon, 7 Jul 2025 10:23:59 +0900
Subject: [PATCH] x509: fix read buffer overrun in SCT timestamps

Prevent reading beyond heap buffer in call to _gnutls_parse_ct_sct
when processing x509 Signed Certificate Timestamps with certain
malformed data. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42530513

Signed-off-by: Andrew Hamilton <adhamilt@gmail.com>
Signed-off-by: Daiki Ueno <ueno@gnu.org>

CVE: CVE-2025-32989
Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/8e5ca951257202089246fa37e93a99d210ee5ca2]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 NEWS                                             |   5 +++++
 lib/x509/x509_ext.c                              |   2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 85efb5680..025e05148 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,11 @@ Copyright (C) 2000-2016 Free Software Foundation, Inc.
 Copyright (C) 2013-2019 Nikos Mavrogiannopoulos
 See the end for copying conditions.
 
+** libgnutls: Fix heap read buffer overrun in parsing X.509 SCTS timestamps
+   Spotted by oss-fuzz and reported by OpenAI Security Research Team,
+   and fix developed by Andrew Hamilton. [GNUTLS-SA-2025-07-07-1,
+   CVSS: medium] [CVE-2025-32989]
+
 * Version 3.8.4 (released 2024-03-18)
 
 ** libgnutls: RSA-OAEP encryption scheme is now supported
diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c
index 064ca8357..05336a0c2 100644
--- a/lib/x509/x509_ext.c
+++ b/lib/x509/x509_ext.c
@@ -3757,7 +3757,7 @@ int gnutls_x509_ext_ct_import_scts(const gnutls_datum_t *ext,
 	}
 
 	length = _gnutls_read_uint16(scts_content.data);
-	if (length < 4) {
+	if (length < 4 || length > scts_content.size) {
 		gnutls_free(scts_content.data);
 		return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 	}
