| commit | 0ed26acce328ec16a3aa635f1ca37365e8c7403a | [log] [tgz] |
|---|---|---|
| author | Dr. Stephen Henson <steve@openssl.org> | Thu Jul 21 15:24:16 2016 +0100 |
| committer | Dr. Stephen Henson <steve@openssl.org> | Fri Jul 22 15:15:17 2016 +0100 |
| tree | a4a634f017e5d9061fb55daccf8bc6f0adf26048 | |
| parent | d0c4415de5eaa555ead6eb99660e46410b45e181 [diff] |
Fix OOB read in TS_OBJ_print_bio(). TS_OBJ_print_bio() misuses OBJ_txt2obj: it should print the result as a null terminated buffer. The length value returned is the total length the complete text reprsentation would need not the amount of data written. CVE-2016-2180 Thanks to Shi Lei for reporting this bug. Reviewed-by: Matt Caswell <matt@openssl.org>