OSSL_CMP_puts() CMP_log_fd() issues

mpeylo / cmpossl

An OpenSSL-based implementation of the Certificate Management Protocol (CMP), defined in IETF RFCs 4210, 4211, and 6712. It is being extended according to the emerging RFCs 'CMP Updates' (CMPv3), 'CMP Algorithms', and 'Lightweight CMP Profile'.

https://github.com/mpeylo/cmpossl/wiki

Other

35 stars 13 forks source link

OSSL_CMP_puts() CMP_log_fd() issues #164

Closed mpeylo closed 5 years ago

mpeylo commented 5 years ago

In e.g. commit d616bb6611a4e3ddeb6dabb563813b384c429ee5

OSSL_CMP_puts() does not return anything in case OPENSSL_NO_STDIO is defined, documentation does not mention how OPENSSL_NO_STDIO affects the function.

In CMP_log_fd():

len gets assigned, but not used afterwards (line 1366)
it is (cannot be) not checked whether msg function parameter is 0-terminated before strlen is used on it (line1367) and documentation appears not to mention that 0-termination would be required

DDvO commented 5 years ago

After recent changes to the log facility, this issue has disappeared for our cmp-dev´ branch. Nevertheless I've just fixed it forcmp`.

Note that, as usual, we implicitly assume that strings of type char * are NUL-terminated.