Commit 9375418a87 for openssl.org

commit 9375418a8758b9229182da5d5922342c08bc7c74
Author: Neil Horman <nhorman@openssl.org>
Date:   Fri Jul 17 14:22:50 2026 -0400

    use safe_math on do_name_ex

    Coverity caught some potential overflows in do_name_ex.  Seems unlikely
    to occur, but lets just do all the adds under safe_math to ensure we
    don't overflow our buffer length.

    Fixes https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1695278

    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    MergeDate: Thu Jul 23 08:24:23 2026
    (Merged from https://github.com/openssl/openssl/pull/31992)

diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c
index 57a14f6f90..4315355632 100644
--- a/crypto/asn1/a_strex.c
+++ b/crypto/asn1/a_strex.c
@@ -12,6 +12,7 @@
 #include "internal/cryptlib.h"
 #include "internal/sizes.h"
 #include "internal/unicode.h"
+#include "internal/safe_math.h"
 #include "crypto/asn1.h"
 #include <openssl/byteorder.h>
 #include <openssl/crypto.h>
@@ -31,6 +32,8 @@

 #define ESC_FLAGS (ASN1_STRFLGS_ESC_2253 | ASN1_STRFLGS_ESC_2254 | ASN1_STRFLGS_ESC_QUOTE | ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB)

+OSSL_SAFE_MATH_SIGNED(int, int)
+
 /*
  * Three IO functions for sending data to memory, a BIO and a FILE
  * pointer.
@@ -438,6 +441,7 @@ static int do_name_ex(char_io *io_ch, void *arg, const X509_NAME *n,
     char objtmp[80];
     const char *objbuf;
     int outlen, len;
+    int err = 0;
     char *sep_dn, *sep_mv, *sep_eq;
     int sep_dn_len, sep_mv_len, sep_eq_len;
     if (indent < 0)
@@ -501,14 +505,20 @@ static int do_name_ex(char_io *io_ch, void *arg, const X509_NAME *n,
             if (prev == X509_NAME_ENTRY_set(ent)) {
                 if (!io_ch(arg, sep_mv, sep_mv_len))
                     return -1;
-                outlen += sep_mv_len;
+                outlen = safe_add_int(outlen, sep_mv_len, &err);
+                if (err != 0)
+                    return -1;
             } else {
                 if (!io_ch(arg, sep_dn, sep_dn_len))
                     return -1;
-                outlen += sep_dn_len;
+                outlen = safe_add_int(outlen, sep_dn_len, &err);
+                if (err != 0)
+                    return -1;
                 if (!do_indent(io_ch, arg, indent))
                     return -1;
-                outlen += indent;
+                outlen = safe_add_int(outlen, indent, &err);
+                if (err != 0)
+                    return -1;
             }
         }
         prev = X509_NAME_ENTRY_set(ent);
@@ -539,11 +549,18 @@ static int do_name_ex(char_io *io_ch, void *arg, const X509_NAME *n,
             if ((objlen < fld_len) && (flags & XN_FLAG_FN_ALIGN)) {
                 if (!do_indent(io_ch, arg, fld_len - objlen))
                     return -1;
-                outlen += fld_len - objlen;
+                outlen = safe_add_int(outlen, fld_len - objlen, &err);
+                if (err != 0)
+                    return -1;
             }
             if (!io_ch(arg, sep_eq, sep_eq_len))
                 return -1;
-            outlen += objlen + sep_eq_len;
+            outlen = safe_add_int(outlen, objlen, &err);
+            if (err != 0)
+                return -1;
+            outlen = safe_add_int(outlen, sep_eq_len, &err);
+            if (err != 0)
+                return -1;
         }
         /*
          * If the field name is unknown then fix up the DER dump flag. We
@@ -558,7 +575,9 @@ static int do_name_ex(char_io *io_ch, void *arg, const X509_NAME *n,
         len = do_print_ex(io_ch, arg, flags | orflags, val);
         if (len < 0)
             return -1;
-        outlen += len;
+        outlen = safe_add_int(outlen, len, &err);
+        if (err != 0)
+            return -1;
     }
     return outlen;
 }