[openssl/openssl] 481a87: Prevent integer overflow in ASN1_mbstring_ncopy

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: 481a871b4c32b762528dab7b039648c723f1394e
      https://github.com/openssl/openssl/commit/481a871b4c32b762528dab7b039648c723f1394e
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-06-24 (Wed, 24 Jun 2026)

  Changed paths:
    M crypto/asn1/a_mbstr.c

  Log Message:
  -----------
  Prevent integer overflow in ASN1_mbstring_ncopy

This prevents a theoretically possible integer overflow
in OPENSSL_malloc(outlen + 1) at the end of ASN1_mbstring_ncopy,
when outlen is exactly INT_MAX.
That affects conversions from MBSTRING_ASC to MBSTRING_UTF8
and MBSTRING_UTF8 to MBSTRING_ASC,
because a terminating zero has to be added to the result.
And also conversions MBSTRING_BMP to MBSTRING_UTF8
in cases when UTF8 characters 0x800..0xFFFF are encoded
as 3-byte UTF8-characters and the resulting UTF8-string
is exactly INT_MAX in size.

Fixes: 97f6b621f7af ("Reject oversized inputs in ASN1_mbstring_ncopy()")

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jun 24 12:56:59 2026
(Merged from https://github.com/openssl/openssl/pull/31529)

(cherry picked from commit 430409b4dc66fcbf01b5b35545a91d41ede6af34)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/01d61d-481a87%40github.com.