CVSROOT: /cvs
Module name: src
Changes by: js...@cvs.openbsd.org 2022/02/11 20:01:59
Modified files:
lib/libcrypto/objects: obj_dat.c
Log message:
Limit OID text conversion to 64 bits per arc.
The current implementation uses an unsigned long, then switches to BN once
the arc exceeds its size. However, the complexity of BN_bn2dec() is
quadratic in the length of number being converted. This means that OIDs
with excessively large arcs take a lot of computation to convert to text.
While the X.660 specification states that arcs are unbounded, in reality
they are not overly large numbers - 640K^W64 bits ought to be enough for
any arc. Remove BN entirely, switch from unsigned long to uin64_t and fail
if an arc exceeds this size.
Identified via oss-fuzz timeouts - should fix #41028 and #44372.
ok tb@
