Repository navigation
[4.1] Fix IP SAN handling in cert_write and cert_req - #11003
Open
JayOfTheKeyboard wants to merge 2 commits into
Open
JayOfTheKeyboard wants to merge 2 commits into
JayOfTheKeyboard wants to merge 2 commits into
Conversation
mbedtls_x509_crt_parse_cn_inet_pton() requires a 16-byte buffer and writes 16 bytes for an IPv6 address, but both programs passed a 4-byte one. Use a 16-byte buffer and record the length the function returns instead of sizeof(ip), so IPv6 addresses are encoded as 16 bytes. Signed-off-by: Jeremy Levartovsky <[email protected]>
Every IP entry in the san list pointed at the same buffer, and the list is only written once all entries are parsed, so san=IP:1.2.3.4;IP:5.6.7.8 produced two copies of 5.6.7.8. Give each IP entry its own buffer and free it with the rest of the list. Signed-off-by: Jeremy Levartovsky <[email protected]>
7 tasks done
gilles-peskine-arm
added
bug
needs-review
github-project-automation
Bot
moved this to In Development
in Non-roadmap pull requests
rohankl-arm
approved these changes
Oct 28, 2026
rohankl-arm
left a comment
rohankl-arm
left a comment
Contributor
There was a problem hiding this comment.
LGTM, faithful backport
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backport of #11002 to the mbedtls-4.1 branch.
The
cert_writeandcert_reqsample programs pass a 4-byte buffer tombedtls_x509_crt_parse_cn_inet_pton(), which writes 16 bytes for an IPv6 address, sosan=IP:2001:db8::1overflows the stack. EveryIP:entry also shared that one buffer, sosan=IP:1.2.3.4;IP:5.6.7.8wrote5.6.7.8twice. The two commits cherry-pick cleanly from #11002. See that PR for the details.Tested the same way on this branch: an ASan and UBSan build of both programs, five
saninputs, with the SAN decoded byopenssl. 6 of 10 checks fail on the parent and 10 of 10 pass with this change.code_style.pyandassemble_changelog.pypass, and both programs build with gcc andMBEDTLS_FATAL_WARNINGS=ON.PR checklist
cert_writeandcert_req. Tested by hand under ASan as described in Fix IP SAN handling in cert_write and cert_req #11002.