Fossil SCM
Enhancements to OpenSSL user-prompt buffer handling.
Commit
82d177fa1427710178911759e0bf6f226854021a7a61138f5752a6954606d8ce
Parent
68b68ce673ed652…
1 file changed
+6
-6
+6
-6
| --- src/http_ssl.c | ||
| +++ src/http_ssl.c | ||
| @@ -328,17 +328,17 @@ | ||
| 328 | 328 | ssl_close(); |
| 329 | 329 | return 1; |
| 330 | 330 | } |
| 331 | 331 | |
| 332 | 332 | if( !sslNoCertVerify && SSL_get_verify_result(ssl)!=X509_V_OK ){ |
| 333 | - int x; | |
| 333 | + int x, desclen; | |
| 334 | 334 | char *desc, *prompt; |
| 335 | 335 | Blob ans; |
| 336 | 336 | char cReply; |
| 337 | 337 | BIO *mem; |
| 338 | - unsigned char md[32]; | |
| 339 | - char zHash[32*2+1]; | |
| 338 | + unsigned char md[EVP_MAX_MD_SIZE]; | |
| 339 | + char zHash[EVP_MAX_MD_SIZE*2+1]; | |
| 340 | 340 | unsigned int mdLength = (int)sizeof(md); |
| 341 | 341 | |
| 342 | 342 | memset(md, 0, sizeof(md)); |
| 343 | 343 | zHash[0] = 0; |
| 344 | 344 | /* MMNNFFPPS */ |
| @@ -365,15 +365,15 @@ | ||
| 365 | 365 | BIO_puts(mem, " subject: "); |
| 366 | 366 | X509_NAME_print_ex(mem, X509_get_subject_name(cert), 0, XN_FLAG_ONELINE); |
| 367 | 367 | BIO_puts(mem, "\n issuer: "); |
| 368 | 368 | X509_NAME_print_ex(mem, X509_get_issuer_name(cert), 0, XN_FLAG_ONELINE); |
| 369 | 369 | BIO_printf(mem, "\n sha256: %s", zHash); |
| 370 | - BIO_get_mem_data(mem, &desc); | |
| 370 | + desclen = BIO_get_mem_data(mem, &desc); | |
| 371 | 371 | |
| 372 | - prompt = mprintf("Unable to verify SSL cert from %s\n%s\n" | |
| 372 | + prompt = mprintf("Unable to verify SSL cert from %s\n%.*s\n" | |
| 373 | 373 | "accept this cert and continue (y/N)? ", |
| 374 | - pUrlData->name, desc); | |
| 374 | + pUrlData->name, desclen, desc); | |
| 375 | 375 | BIO_free(mem); |
| 376 | 376 | |
| 377 | 377 | prompt_user(prompt, &ans); |
| 378 | 378 | free(prompt); |
| 379 | 379 | cReply = blob_str(&ans)[0]; |
| 380 | 380 |
| --- src/http_ssl.c | |
| +++ src/http_ssl.c | |
| @@ -328,17 +328,17 @@ | |
| 328 | ssl_close(); |
| 329 | return 1; |
| 330 | } |
| 331 | |
| 332 | if( !sslNoCertVerify && SSL_get_verify_result(ssl)!=X509_V_OK ){ |
| 333 | int x; |
| 334 | char *desc, *prompt; |
| 335 | Blob ans; |
| 336 | char cReply; |
| 337 | BIO *mem; |
| 338 | unsigned char md[32]; |
| 339 | char zHash[32*2+1]; |
| 340 | unsigned int mdLength = (int)sizeof(md); |
| 341 | |
| 342 | memset(md, 0, sizeof(md)); |
| 343 | zHash[0] = 0; |
| 344 | /* MMNNFFPPS */ |
| @@ -365,15 +365,15 @@ | |
| 365 | BIO_puts(mem, " subject: "); |
| 366 | X509_NAME_print_ex(mem, X509_get_subject_name(cert), 0, XN_FLAG_ONELINE); |
| 367 | BIO_puts(mem, "\n issuer: "); |
| 368 | X509_NAME_print_ex(mem, X509_get_issuer_name(cert), 0, XN_FLAG_ONELINE); |
| 369 | BIO_printf(mem, "\n sha256: %s", zHash); |
| 370 | BIO_get_mem_data(mem, &desc); |
| 371 | |
| 372 | prompt = mprintf("Unable to verify SSL cert from %s\n%s\n" |
| 373 | "accept this cert and continue (y/N)? ", |
| 374 | pUrlData->name, desc); |
| 375 | BIO_free(mem); |
| 376 | |
| 377 | prompt_user(prompt, &ans); |
| 378 | free(prompt); |
| 379 | cReply = blob_str(&ans)[0]; |
| 380 |
| --- src/http_ssl.c | |
| +++ src/http_ssl.c | |
| @@ -328,17 +328,17 @@ | |
| 328 | ssl_close(); |
| 329 | return 1; |
| 330 | } |
| 331 | |
| 332 | if( !sslNoCertVerify && SSL_get_verify_result(ssl)!=X509_V_OK ){ |
| 333 | int x, desclen; |
| 334 | char *desc, *prompt; |
| 335 | Blob ans; |
| 336 | char cReply; |
| 337 | BIO *mem; |
| 338 | unsigned char md[EVP_MAX_MD_SIZE]; |
| 339 | char zHash[EVP_MAX_MD_SIZE*2+1]; |
| 340 | unsigned int mdLength = (int)sizeof(md); |
| 341 | |
| 342 | memset(md, 0, sizeof(md)); |
| 343 | zHash[0] = 0; |
| 344 | /* MMNNFFPPS */ |
| @@ -365,15 +365,15 @@ | |
| 365 | BIO_puts(mem, " subject: "); |
| 366 | X509_NAME_print_ex(mem, X509_get_subject_name(cert), 0, XN_FLAG_ONELINE); |
| 367 | BIO_puts(mem, "\n issuer: "); |
| 368 | X509_NAME_print_ex(mem, X509_get_issuer_name(cert), 0, XN_FLAG_ONELINE); |
| 369 | BIO_printf(mem, "\n sha256: %s", zHash); |
| 370 | desclen = BIO_get_mem_data(mem, &desc); |
| 371 | |
| 372 | prompt = mprintf("Unable to verify SSL cert from %s\n%.*s\n" |
| 373 | "accept this cert and continue (y/N)? ", |
| 374 | pUrlData->name, desclen, desc); |
| 375 | BIO_free(mem); |
| 376 | |
| 377 | prompt_user(prompt, &ans); |
| 378 | free(prompt); |
| 379 | cReply = blob_str(&ans)[0]; |
| 380 |