Fix CVE-2020-7919

Cherry-picked from upstream:
https://github.com/golang/go/commit/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574

Gbp-Pq: Name 0009-Fix-CVE-2020-7919.patch

diff --git a/src/vendor/golang_org/x/crypto/cryptobyte/asn1.go b/src/vendor/golang_org/x/crypto/cryptobyte/asn1.go
index 08314b47d1c56cb6956dd8a1fc478b893933a745..e7c32e3c7b77f1e4539ba53c69cc7b141f53b68c 100644 (file)
--- a/src/vendor/golang_org/x/crypto/cryptobyte/asn1.go
+++ b/src/vendor/golang_org/x/crypto/cryptobyte/asn1.go
@@ -470,7 +470,8 @@ func (s *String) ReadASN1GeneralizedTime(out *time.Time) bool {
 // It reports whether the read was successful.
 func (s *String) ReadASN1BitString(out *encoding_asn1.BitString) bool {
        var bytes String
-       if !s.ReadASN1(&bytes, asn1.BIT_STRING) || len(bytes) == 0 {
+       if !s.ReadASN1(&bytes, asn1.BIT_STRING) || len(bytes) == 0 ||
+               len(bytes)*8/8 != len(bytes) {
                return false
        }
 
@@ -740,7 +741,7 @@ func (s *String) readASN1(out *String, outTag *asn1.Tag, skipHeader bool) bool {
                length = headerLen + len32
        }
 
-       if uint32(int(length)) != length || !s.ReadBytes((*[]byte)(out), int(length)) {
+       if int(length) < 0 || !s.ReadBytes((*[]byte)(out), int(length)) {
                return false
        }
        if skipHeader && !out.Skip(int(headerLen)) {

diff --git a/src/vendor/golang_org/x/crypto/cryptobyte/string.go b/src/vendor/golang_org/x/crypto/cryptobyte/string.go
index 39bf98aeead8160094c007d8edb4066b5720283c..589d297e6be8f6d5f2a179a02f2216536263efb5 100644 (file)
--- a/src/vendor/golang_org/x/crypto/cryptobyte/string.go
+++ b/src/vendor/golang_org/x/crypto/cryptobyte/string.go
@@ -24,7 +24,7 @@ type String []byte
 // read advances a String by n bytes and returns them. If less than n bytes
 // remain, it returns nil.
 func (s *String) read(n int) []byte {
-       if len(*s) < n {
+       if len(*s) < n || n < 0 {
                return nil
        }
        v := (*s)[:n]
@@ -105,11 +105,6 @@ func (s *String) readLengthPrefixed(lenLen int, outChild *String) bool {
                length = length << 8
                length = length | uint32(b)
        }
-       if int(length) < 0 {
-               // This currently cannot overflow because we read uint24 at most, but check
-               // anyway in case that changes in the future.
-               return false
-       }
        v := s.read(int(length))
        if v == nil {
                return false