File php-5.2.14-CVE-2013-6420.patch of Package php-5.2.17

File php-5.2.14-CVE-2013-6420.patch of Package php-5.2.17 (Revision 19)

Currently displaying revision 19, show latest

https://bugzilla.redhat.com/attachment.cgi?id=831933&action=diff&context=patch&collapsed=&headers=1&format=raw
--- ext/openssl/openssl.c	2013-11-28 13:03:15.000000000 +0100
+++ ext/openssl/openssl.c	2013-11-28 12:57:36.000000000 +0100
@@ -688,18 +688,28 @@ 
 	char * thestr;
 	long gmadjust = 0;
 
-	if (timestr->length < 13) {
+	if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp");
+		return (time_t)-1;
+	}
+
+	if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
+		return (time_t)-1;
+	}
+
+	if (ASN1_STRING_length(timestr) < 13) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "extension author too lazy to parse %s correctly", timestr->data);
 		return (time_t)-1;
 	}
 
-	strbuf = estrdup((char *)timestr->data);
+	strbuf = estrdup((char *)ASN1_STRING_data(timestr));
 
 	memset(&thetime, 0, sizeof(thetime));
 
 	/* we work backwards so that we can use atoi more easily */
 
-	thestr = strbuf + timestr->length - 3;
+	thestr = strbuf + ASN1_STRING_length(timestr) - 3;
 
 	thetime.tm_sec = atoi(thestr);
 	*thestr = '\0';