[openssl/openssl] 9c2804: Prevent integer overflow in ASN1_mbstring_ncopy

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: 9c2804378f447144ed2d64838cd5531fb737fca1
      https://github.com/openssl/openssl/commit/9c2804378f447144ed2d64838cd5531fb737fca1
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-06-24 (Wed, 24 Jun 2026)

  Changed paths:
    M crypto/asn1/a_mbstr.c

  Log Message:
  -----------
  Prevent integer overflow in ASN1_mbstring_ncopy

This prevents a theoretically possible integer overflow
in OPENSSL_malloc(outlen + 1) at the end of ASN1_mbstring_ncopy,
when outlen is exactly INT_MAX.
That affects conversions from MBSTRING_ASC to MBSTRING_UTF8
and MBSTRING_UTF8 to MBSTRING_ASC,
because a terminating zero has to be added to the result.
And also conversions MBSTRING_BMP to MBSTRING_UTF8
in cases when UTF8 characters 0x800..0xFFFF are encoded
as 3-byte UTF8-characters and the resulting UTF8-string
is exactly INT_MAX in size.

Fixes: 97f6b621f7af ("Reject oversized inputs in ASN1_mbstring_ncopy()")

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jun 24 12:49:08 2026
(Merged from https://github.com/openssl/openssl/pull/31527)

(cherry picked from commit 25b37961f7341de7ccb0f01e61fcdefc61a30e36)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/8c87b7-9c2804%40github.com.