CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

gnutls: patch reject zero-length version in certificate request

Browse Source 
Pick relevant commit from 3.8.10 release MR [1].
The MR contains referece to undiscoled issue, so any security relevant
patch should be picked.

Binary test file was added as separate file as binary diffs are not
supported.

[1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979

(From OE-Core rev: d1aaef9bbaa240c83cc7d485b55570449203da0b)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko 2025-07-27 19:49:16 +02:00 committed by Steve Sakoman
parent 5de981dd1c
commit bee76dfe7e
3 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
meta/recipes-support/gnutls/gnutls/0001-x509-reject-zero-length-version-in-certificate-reque.patch Normal file
View File

@ -0,0 +1,37 @@
From 61c0505634a6faacf9fa0723843408aa0d3fb90a Mon Sep 17 00:00:00 2001
From: Andrew Hamilton <adhamilt@gmail.com>
Date: Mon, 7 Jul 2025 10:35:54 +0900
Subject: [PATCH] x509: reject zero-length version in certificate request
Ensure zero size asn1 values are considered invalid in
gnutls_x509_crq_get_version, this ensures crq version is not used
uninitialized. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42536706
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com>
Signed-off-by: Daiki Ueno <ueno@gnu.org>
Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/61c0505634a6faacf9fa0723843408aa0d3fb90a]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/x509/crq.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/x509/crq.c b/lib/x509/crq.c
index 19e13623c..9e9801d2b 100644
--- a/lib/x509/crq.c
+++ b/lib/x509/crq.c
@@ -615,6 +615,13 @@ int gnutls_x509_crq_get_version(gnutls_x509_crq_t crq)
return _gnutls_asn2err(result);
}
+ /* Note that asn1_read_value can return success with */
+ /* len set to zero (without setting the data) in some */
+ /* conditions. */
+ if (unlikely(len <= 0)) {
+ return gnutls_assert_val(GNUTLS_E_ASN1_VALUE_NOT_VALID);
+ }
+
return (int)version[0] + 1;
}

BIN
meta/recipes-support/gnutls/gnutls/3e94dcdff862ef5d6db8b5cc8e59310b5f0cdfe2 Normal file
View File

Binary file not shown.

5
meta/recipes-support/gnutls/gnutls_3.8.4.bb
View File

@ -28,6 +28,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://04939b75417cc95b7372c6f208c4bda4579bdc34 \
file://0001-psk-fix-read-buffer-overrun-in-the-pre_shared_key-ex.patch \
file://5477db1bb507a35e8833c758ce344f4b5b246d8e \
file://0001-x509-reject-zero-length-version-in-certificate-reque.patch \
file://3e94dcdff862ef5d6db8b5cc8e59310b5f0cdfe2 \
"
SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"
@ -68,9 +70,10 @@ do_configure:prepend() {
done
# binary files cannot be delivered as diff
mkdir -p ${S}/fuzz/gnutls_x509_parser_fuzzer.repro/ ${S}/fuzz/gnutls_psk_client_fuzzer.repro/
mkdir -p ${S}/fuzz/gnutls_x509_parser_fuzzer.repro/ ${S}/fuzz/gnutls_psk_client_fuzzer.repro/ ${S}/fuzz/gnutls_x509_crq_parser_fuzzer.repro/
cp ${WORKDIR}/04939b75417cc95b7372c6f208c4bda4579bdc34 ${S}/fuzz/gnutls_x509_parser_fuzzer.repro/
cp ${WORKDIR}/5477db1bb507a35e8833c758ce344f4b5b246d8e ${S}/fuzz/gnutls_psk_client_fuzzer.repro/
cp ${WORKDIR}/3e94dcdff862ef5d6db8b5cc8e59310b5f0cdfe2 ${S}/fuzz/gnutls_x509_crq_parser_fuzzer.repro/
}
do_compile_ptest() {