luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nss: return error if seemingly stuck in a cert loop

Browse Source 
CVE-2022-27781

Reported-by: Florian Kohnhäuser
Bug: https://curl.se/docs/CVE-2022-27781.html
Closes #8822
This commit is contained in:
Daniel Stenberg 2022-05-09 10:07:15 +02:00
parent 46d45ea3af
commit 5c7da89d40
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/vtls/nss.c
View File

@ -983,6 +983,9 @@ static void display_cert_info(struct Curl_easy *data,
PR_Free(common_name);
}
/* A number of certs that will never occur in a real server handshake */
#define TOO_MANY_CERTS 300
static CURLcode display_conn_info(struct Curl_easy *data, PRFileDesc *sock)
{
CURLcode result = CURLE_OK;
@ -1018,6 +1021,11 @@ static CURLcode display_conn_info(struct Curl_easy *data, PRFileDesc *sock)
cert2 = CERT_FindCertIssuer(cert, now, certUsageSSLCA);
while(cert2) {
i++;
if(i >= TOO_MANY_CERTS) {
CERT_DestroyCertificate(cert2);
failf(data, "certificate loop");
return CURLE_SSL_CERTPROBLEM;
}
if(cert2->isRoot) {
CERT_DestroyCertificate(cert2);
break;