openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-04-30 09:06:11 +00:00
Code Issues Projects Releases Wiki Activity

rpki-client: fix incorrect error exit in x509_get_time()

Browse Source 
A UTCTime represents a time between Jan 1, 1950 and Dec 31, 2049. This
includes Dec 31, 1969, 23:59:59 UTC, which translates to epoch -1 when
converted as a time_t. timegm()'s in-band error conflates this time with
its error return, so a hard error for this creates a DoS.

Instead, return an error for ASN.1 times that translate to negative time_t
and bubble up the error to reject the RPKI product as malformed. Real life
notBefore (or equivalent) are in the ongoing millenium, although strictly
speaking this is not guaranteed since Validity windows need not nest.

Thanks to Yuheng Zhang, Qi Wang, Jianjun Chen from Tsinghua University,
and Teatime Lab for reporting.

ok claudio job
This commit is contained in:
tb
2026-04-13 03:36:10 +00:00
parent 380397a6e9
commit ef90b149a7
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
usr.sbin/rpki-client/x509.c
View File

@@ -1,4 +1,4 @@
/* $OpenBSD: x509.c,v 1.130 2026/04/07 14:38:04 job Exp $ */
/* $OpenBSD: x509.c,v 1.131 2026/04/13 03:36:10 tb Exp $ */
/*
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
* Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -298,8 +298,8 @@ x509_get_time(const ASN1_TIME *at, time_t *t)
return 0;
if (!ASN1_TIME_to_tm(at, &tm))
return 0;
if ((*t = timegm(&tm)) == -1)
errx(1, "timegm failed");
if ((*t = timegm(&tm)) < 0)
return 0;
return 1;
}