Tongsuo-Project / Tongsuo

铜锁/Tongsuo is a Modern Cryptographic Primitives and Protocols Library
https://www.tongsuo.net
Apache License 2.0
1.16k stars 186 forks source link

Avoid type errors in EAI-related name check logic. #652

Open dongbeiouba opened 2 months ago

dongbeiouba commented 2 months ago

The incorrectly typed data is read only, used in a compare operation, so neither remote code execution, nor memory content disclosure were possible. However, applications performing certificate name checks were vulnerable to denial of service.

The GENERAL_TYPE data type is a union, and we must take care to access the correct member, based on gen->type, not all the member fields have the same structure, and a segfault is possible if the wrong member field is read.

The code in question was lightly refactored with the intent to make it more obviously correct.

Fixes CVE-2024-6119

Checklist
dongbeiouba commented 1 month ago

ping @Tongsuo-Project/tongsuo-maintainers