[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[Rich Salz]

The branch OpenSSL_1_0_2-stable has been updated
       via  31c8b265591a0aaa462a1f3eb5770661aaac67db (commit)
      from  917552f32260cd9b8c9018cdb15893ebdd9ab39d (commit)


- Log -----------------------------------------------------------------
commit 31c8b265591a0aaa462a1f3eb5770661aaac67db
Author: Rich Salz <rsalz at openssl.org>
Date:   Tue Aug 22 11:44:41 2017 -0400

    Avoid out-of-bounds read
    
    Fixes CVE 2017-3735
    
    Reviewed-by: Kurt Roeckx <kurt at roeckx.be>
    (Merged from https://github.com/openssl/openssl/pull/4276)
    
    (cherry picked from commit b23171744b01e473ebbfd6edad70c1c3825ffbcd)

-----------------------------------------------------------------------

Summary of changes:
 crypto/x509v3/v3_addr.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/crypto/x509v3/v3_addr.c b/crypto/x509v3/v3_addr.c
index 1290dec..af080a0 100644
--- a/crypto/x509v3/v3_addr.c
+++ b/crypto/x509v3/v3_addr.c
@@ -130,10 +130,12 @@ static int length_from_afi(const unsigned afi)
  */
 unsigned int v3_addr_get_afi(const IPAddressFamily *f)
 {
-    return ((f != NULL &&
-             f->addressFamily != NULL && f->addressFamily->data != NULL)
-            ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
-            : 0);
+    if (f == NULL
+            || f->addressFamily == NULL
+            || f->addressFamily->data == NULL
+            || f->addressFamily->length < 2)
+        return 0;
+    return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
 }
 
 /*