libest icon indicating copy to clipboard operation
libest copied to clipboard

Possible Buffer overflow: add length checks to header creation

Open McRoot12 opened this issue 8 years ago • 1 comments

est_client.c:

When the generated header is bigger than EST_HTTP_HDR_MAX the

/*
 * Build the HTTP body containing the pkcs10 request
 */
memcpy_s(http_data + hdr_len, EST_HTTP_REQ_DATA_MAX,
         bptr->data, (rsize_t)bptr->length);
hdr_len += bptr->length;

will result in a memory corruption, because of http_data + hdr_len

est_server.c

snprintf() should check how much space is left in the header

McRoot12 avatar Jul 24 '17 11:07 McRoot12

est_server_http.c changes should use hdrlen, not hdr_len

finitelife avatar Sep 01 '19 07:09 finitelife