diff options
| author | Christian Heimes <christian@python.org> | 2019-01-15 22:47:42 (GMT) |
|---|---|---|
| committer | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-01-15 22:47:42 (GMT) |
| commit | a37f52436f9aa4b9292878b72f3ff1480e2606c3 (patch) | |
| tree | 241263055db201418a7288a883eefd783ff59364 /Modules/_ssl.c | |
| parent | c9f872b0bdce5888f1879fa74e098bf4a05430c5 (diff) | |
| download | cpython-a37f52436f9aa4b9292878b72f3ff1480e2606c3.zip cpython-a37f52436f9aa4b9292878b72f3ff1480e2606c3.tar.gz cpython-a37f52436f9aa4b9292878b72f3ff1480e2606c3.tar.bz2 | |
bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.
Signed-off-by: Christian Heimes <christian@python.org>
https://bugs.python.org/issue35746
Diffstat (limited to 'Modules/_ssl.c')
| -rw-r--r-- | Modules/_ssl.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 4e3352d..0e720e2 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1515,6 +1515,10 @@ _get_crl_dp(X509 *certificate) { STACK_OF(GENERAL_NAME) *gns; dp = sk_DIST_POINT_value(dps, i); + if (dp->distpoint == NULL) { + /* Ignore empty DP value, CVE-2019-5010 */ + continue; + } gns = dp->distpoint->name.fullname; for (j=0; j < sk_GENERAL_NAME_num(gns); j++) { |