From 330f59dcb39386b3d640ce94fcd3f75e1668ad88 Mon Sep 17 00:00:00 2001 From: Michael Catanzaro Date: Mon, 4 Aug 2025 15:10:21 -0500 Subject: [PATCH 1/3] openssl: properly check return value when writing to BIO objects In particular, we will read out of bounds, and then write the invalid memory, if BIO_write() fails when getting the PROP_CERTIFICATE_PEM property. Here we attempt to check the return value, but the check is not correct. This also fixes a leak of the BIO in the same place. Also add error checking to PROP_SUBJECT_NAME and PROP_ISSUER_NAME, for good measure. Fixes #226 CVE: CVE-2025-60018 Upstream-Status: Backport Signed-off-by: Ross Burton --- tls/openssl/gtlscertificate-openssl.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/tls/openssl/gtlscertificate-openssl.c b/tls/openssl/gtlscertificate-openssl.c index 648f3e8..b536559 100644 --- a/tls/openssl/gtlscertificate-openssl.c +++ b/tls/openssl/gtlscertificate-openssl.c @@ -362,15 +362,12 @@ g_tls_certificate_openssl_get_property (GObject *object, case PROP_CERTIFICATE_PEM: bio = BIO_new (BIO_s_mem ()); - if (!PEM_write_bio_X509 (bio, openssl->cert) || !BIO_write (bio, "\0", 1)) - certificate_pem = NULL; - else + if (PEM_write_bio_X509 (bio, openssl->cert) == 1 && BIO_write (bio, "\0", 1) == 1) { BIO_get_mem_data (bio, &certificate_pem); g_value_set_string (value, certificate_pem); - - BIO_free_all (bio); } + BIO_free_all (bio); break; case PROP_PRIVATE_KEY: @@ -411,8 +408,12 @@ g_tls_certificate_openssl_get_property (GObject *object, case PROP_SUBJECT_NAME: bio = BIO_new (BIO_s_mem ()); name = X509_get_subject_name (openssl->cert); - X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS); - BIO_write (bio, "\0", 1); + if (X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS) < 0 || + BIO_write (bio, "\0", 1) != 1) + { + BIO_free_all (bio); + break; + } BIO_get_mem_data (bio, (char **)&name_string); g_value_set_string (value, name_string); BIO_free_all (bio); @@ -421,9 +422,13 @@ g_tls_certificate_openssl_get_property (GObject *object, case PROP_ISSUER_NAME: bio = BIO_new (BIO_s_mem ()); name = X509_get_issuer_name (openssl->cert); - X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS); - BIO_write (bio, "\0", 1); - BIO_get_mem_data (bio, &name_string); + if (X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS) < 0 || + BIO_write (bio, "\0", 1) != 1) + { + BIO_free_all (bio); + break; + } + BIO_get_mem_data (bio, (char **)&name_string); g_value_set_string (value, name_string); BIO_free_all (bio); break; -- 2.43.0