From owner-svn-src-stable-10@freebsd.org  Wed Nov 29 05:35:29 2017
Return-Path: <owner-svn-src-stable-10@freebsd.org>
Delivered-To: svn-src-stable-10@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5828CDF8E9D;
 Wed, 29 Nov 2017 05:35:29 +0000 (UTC)
 (envelope-from delphij@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2610:1c1:1:6068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 2407165E0E;
 Wed, 29 Nov 2017 05:35:29 +0000 (UTC)
 (envelope-from delphij@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id vAT5ZSkB096123;
 Wed, 29 Nov 2017 05:35:28 GMT (envelope-from delphij@FreeBSD.org)
Received: (from delphij@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id vAT5ZSRn096122;
 Wed, 29 Nov 2017 05:35:28 GMT (envelope-from delphij@FreeBSD.org)
Message-Id: <201711290535.vAT5ZSRn096122@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: delphij set sender to
 delphij@FreeBSD.org using -f
From: Xin LI <delphij@FreeBSD.org>
Date: Wed, 29 Nov 2017 05:35:28 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject: svn commit: r326357 - stable/10/crypto/openssl/crypto/x509v3
X-SVN-Group: stable-10
X-SVN-Commit-Author: delphij
X-SVN-Commit-Paths: stable/10/crypto/openssl/crypto/x509v3
X-SVN-Commit-Revision: 326357
X-SVN-Commit-Repository: base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-stable-10@freebsd.org
X-Mailman-Version: 2.1.25
Precedence: list
List-Id: SVN commit messages for only the 10-stable src tree
 <svn-src-stable-10.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-stable-10>, 
 <mailto:svn-src-stable-10-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-stable-10/>
List-Post: <mailto:svn-src-stable-10@freebsd.org>
List-Help: <mailto:svn-src-stable-10-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10>, 
 <mailto:svn-src-stable-10-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Nov 2017 05:35:29 -0000

Author: delphij
Date: Wed Nov 29 05:35:28 2017
New Revision: 326357
URL: https://svnweb.freebsd.org/changeset/base/326357

Log:
  Avoid out-of-bounds read.
  
  Security:	CVE-2017-3735
  Security:	FreeBSD-SA-17:11.openssl
  Obtained from:	OpenSSL https://github.com/openssl/openssl/pull/4276

Modified:
  stable/10/crypto/openssl/crypto/x509v3/v3_addr.c

Modified: stable/10/crypto/openssl/crypto/x509v3/v3_addr.c
==============================================================================
--- stable/10/crypto/openssl/crypto/x509v3/v3_addr.c	Wed Nov 29 05:07:54 2017	(r326356)
+++ stable/10/crypto/openssl/crypto/x509v3/v3_addr.c	Wed Nov 29 05:35:28 2017	(r326357)
@@ -130,10 +130,12 @@ static int length_from_afi(const unsigned afi)
  */
 unsigned int v3_addr_get_afi(const IPAddressFamily *f)
 {
-    return ((f != NULL &&
-             f->addressFamily != NULL && f->addressFamily->data != NULL)
-            ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
-            : 0);
+    if (f == NULL
+            || f->addressFamily == NULL
+            || f->addressFamily->data == NULL
+            || f->addressFamily->length < 2)
+        return 0;
+    return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
 }
 
 /*