diff options
| author | Matt Caswell <matt@openssl.org> | 2023-04-26 15:04:42 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2023-05-08 10:33:48 +0100 |
| commit | 5f3adf396b06ee3b81938468995e69cff4ca64d1 (patch) | |
| tree | 2d535f1599a51fd88b7b437629bb26b0e86de87a | |
| parent | d98f4212b778e3b6b7c15b9fce0a3531f59777a2 (diff) | |
| download | openssl-new-5f3adf396b06ee3b81938468995e69cff4ca64d1.tar.gz | |
Prevent a fuzzing timeout in the conf fuzzer
The fuzzer was creating a config file with large numbers of includes
which are expensive to process. However this should not cause a security
issue, and should never happen in normal operation so we can ignore it.
Fixes ossfuzz issue 57718.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20839)
| -rw-r--r-- | crypto/conf/conf_def.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/crypto/conf/conf_def.c b/crypto/conf/conf_def.c index 5e81d9e941..2a2b3d2114 100644 --- a/crypto/conf/conf_def.c +++ b/crypto/conf/conf_def.c @@ -226,6 +226,9 @@ static int def_load_bio(CONF *conf, BIO *in, long *line) char *dirpath = NULL; OPENSSL_DIR_CTX *dirctx = NULL; #endif +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + int numincludes = 0; +#endif if ((buff = BUF_MEM_new()) == NULL) { ERR_raise(ERR_LIB_CONF, ERR_R_BUF_LIB); @@ -438,6 +441,20 @@ static int def_load_bio(CONF *conf, BIO *in, long *line) const char *include_dir = ossl_safe_getenv("OPENSSL_CONF_INCLUDE"); char *include_path = NULL; +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + /* + * The include processing below can cause the "conf" fuzzer to + * timeout due to the fuzzer inserting large and complicated + * includes - with a large amount of time spent in + * OPENSSL_strlcat/OPENSSL_strcpy. This is not a security + * concern because config files should never come from untrusted + * sources. We just set an arbitrary limit on the allowed + * number of includes when fuzzing to prevent this timeout. + */ + if (numincludes++ > 10) + goto err; +#endif + if (include_dir == NULL) include_dir = conf->includedir; |