From 704bc9916ccd8c034f912f13b75fd890a19eb3f3 Mon Sep 17 00:00:00 2001 From: Steven Bellock Date: Tue, 27 Jan 2026 12:02:37 -0800 Subject: [PATCH] Fix security vulnerability in GET_CSR parsing code Signed-off-by: Steven Bellock Co-Authored-By: Nicholas Carlini Fixes: https://github.com/DMTF/libspdm/security/advisories/GHSA-j54w-759w-xj3m Upstream: https://github.com/DMTF/libspdm/commit/704bc9916ccd8c034f912f13b75fd890a19eb3f3 Signed-off-by: Titouan Christophe --- os_stub/cryptlib_mbedtls/pk/x509.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/os_stub/cryptlib_mbedtls/pk/x509.c b/os_stub/cryptlib_mbedtls/pk/x509.c index 65eff62bfd5..1b5d60d4f92 100644 --- a/os_stub/cryptlib_mbedtls/pk/x509.c +++ b/os_stub/cryptlib_mbedtls/pk/x509.c @@ -1768,6 +1768,19 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len, (libspdm_consttime_is_mem_equal(cur->oid, internal_p, obj_len))) { /*Concat subject string*/ + /*move to string*/ + internal_p += obj_len; + ret = libspdm_asn1_get_tag(&internal_p, end, &obj_len, cur->default_tag); + if (!ret) { + return false; + } + + /*check total space needed: name + '=' + value + ',' + '\0'*/ + if (buff_len < (int32_t)(cur->name_len + 1 + obj_len + 1 + 1)) { + LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,"the buffer is too small")); + return false; + } + /*for example: CN=*/ libspdm_copy_mem(buffer, buff_len, cur->name, cur->name_len); buff_len = (int32_t)(buff_len - cur->name_len); @@ -1776,13 +1789,6 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len, buff_len--; buffer++; - /*move to string*/ - internal_p += obj_len; - ret = libspdm_asn1_get_tag(&internal_p, end, &obj_len, cur->default_tag); - if (!ret) { - return false; - } - /*for example: AU,*/ libspdm_copy_mem(buffer, buff_len, internal_p, obj_len); buff_len = (int32_t)(buff_len - obj_len); @@ -1790,11 +1796,6 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len, *buffer = ','; buff_len--; buffer++; - - if (buff_len < 0) { - LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,"the buffer is too small")); - return false; - } break; } }