Commit b8424c0d84 for openssl.org
commit b8424c0d848ac2526fc3c7b9a325be000b119fd4
Author: Bob Beck <beck@openssl.org>
Date: Wed Aug 5 13:02:57 2026 -0600
Fix unguarded memcpy's asn1_type_get_int_oct()and X509_NAME_get_text_by_OBJ()
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Merge-date: Thu Aug 27 13:52:45 2026
Merged-from: https://github.com/openssl/openssl/pull/32178
diff --git a/crypto/asn1/evp_asn1.c b/crypto/asn1/evp_asn1.c
index 721d80b9f6..6edcfa7440 100644
--- a/crypto/asn1/evp_asn1.c
+++ b/crypto/asn1/evp_asn1.c
@@ -94,7 +94,7 @@ static int asn1_type_get_int_oct(ASN1_OCTET_STRING *oct, int32_t anum,
else
n = max_len;
- if (data != NULL)
+ if (data != NULL && n > 0)
memcpy(data, ASN1_STRING_get0_data(oct), n);
return ret;
diff --git a/crypto/x509/x509name.c b/crypto/x509/x509name.c
index 653137dd71..e5766d1b49 100644
--- a/crypto/x509/x509name.c
+++ b/crypto/x509/x509name.c
@@ -45,7 +45,8 @@ int X509_NAME_get_text_by_OBJ(const X509_NAME *name, const ASN1_OBJECT *obj,
if (len <= 0)
return 0;
i = (data->length > (len - 1)) ? (len - 1) : data->length;
- memcpy(buf, data->data, i);
+ if (i > 0)
+ memcpy(buf, data->data, i);
buf[i] = '\0';
return i;
}