libest
libest copied to clipboard
Possible Buffer overflow: add length checks to header creation
est_client.c:
When the generated header is bigger than EST_HTTP_HDR_MAX the
/*
* Build the HTTP body containing the pkcs10 request
*/
memcpy_s(http_data + hdr_len, EST_HTTP_REQ_DATA_MAX,
bptr->data, (rsize_t)bptr->length);
hdr_len += bptr->length;
will result in a memory corruption, because of http_data + hdr_len
est_server.c
snprintf() should check how much space is left in the header
est_server_http.c changes should use hdrlen, not hdr_len