package/wolfssl: add upstream security fix for CVE-2019–18840
authorPeter Korsgaard <peter@korsgaard.com>
Thu, 28 Nov 2019 15:37:18 +0000 (16:37 +0100)
committerPeter Korsgaard <peter@korsgaard.com>
Fri, 29 Nov 2019 09:12:58 +0000 (10:12 +0100)
commit92327cd9e2c8779e0fadf42f4d41959c03991eab
tree07b97a6d71d54aaa74ce57b27ee61a5425449850
parentab566a9acccc32658547c4028d1cd7447b7668b0
package/wolfssl: add upstream security fix for CVE-2019–18840

Fixes the following security vulnerability:

- CVE-2019-18840: In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity
  checks of memory accesses in parsing ASN.1 certificate data while
  handshaking.  Specifically, there is a one-byte heap-based buffer overflow
  inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because
  the domain name location index is mishandled.  Because a pointer is
  overwritten, there is an invalid free.

For details, see the writeup:
https://medium.com/@social_62682/heap-overflow-in-wolfssl-cve-2019-18840-185d233c27de

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/wolfssl/0001-Check-domain-name-location-index-hasn-t-exceed-maxim.patch [new file with mode: 0644]