i2d_name_canon(): Check overflow in len accumulation

Fixes Coverity 1604638 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Todd Short <[email protected]> (Merged from openssl#24930) (cherry picked from commit b2deefb) (cherry picked from commit dd744cd) (cherry picked from commit a3bfc4f)
quictls · Jul 21, 2024 · 5d44130 · 5d44130
1 parent a2bc3df
commit 5d44130
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/crypto/x509/x_name.c b/crypto/x509/x_name.c
@@ -476,8 +476,8 @@ static int i2d_name_canon(const STACK_OF(STACK_OF_X509_NAME_ENTRY) * _intname,
         v = sk_ASN1_VALUE_value(intname, i);
         ltmp = ASN1_item_ex_i2d(&v, in,
                                 ASN1_ITEM_rptr(X509_NAME_ENTRIES), -1, -1);
-        if (ltmp < 0)
-            return ltmp;
+        if (ltmp < 0 || len > INT_MAX - ltmp)
+            return -1;
         len += ltmp;
     }
     return len;