From 88ee127097314172607fd4c3d8e233e8c344012f Mon Sep 17 00:00:00 2001 From: Ilja van Sprundel Date: Tue, 30 Aug 2022 23:43:18 +0200 Subject: [PATCH] update parseCertificate() to guarantee version cannot be negative After the call to ReadOptionalASN1Integer() Version can be really large (e.g., 2,147,483,647) when performing the Version++ on line 823. In that case it would then wrap, leading to a negative Version, which will pass the version check on line 824. This change adds a check to make sure Version is reasonable prior to the increment, thereby guaranteeing it will not wrap. --- src/crypto/x509/parser.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/crypto/x509/parser.go b/src/crypto/x509/parser.go index a2d3d809642..be6a5798e58 100644 --- a/src/crypto/x509/parser.go +++ b/src/crypto/x509/parser.go @@ -815,7 +815,7 @@ func parseCertificate(der []byte) (*Certificate, error) { if !tbs.ReadOptionalASN1Integer(&cert.Version, cryptobyte_asn1.Tag(0).Constructed().ContextSpecific(), 0) { return nil, errors.New("x509: malformed version") } - if cert.Version < 0 { + if cert.Version < 0 || cert.Version > 3 { return nil, errors.New("x509: malformed version") } // for backwards compat reasons Version is one-indexed,