Skip to content

Conversation

@McRoot12
Copy link

est_client.c:

When the generated header is bigger than EST_HTTP_HDR_MAX the

/*
 * Build the HTTP body containing the pkcs10 request
 */
memcpy_s(http_data + hdr_len, EST_HTTP_REQ_DATA_MAX,
         bptr->data, (rsize_t)bptr->length);
hdr_len += bptr->length;

will result in a memory corruption, because of http_data + hdr_len

est_server.c

snprintf() should check how much space is left in the header

@finitelife
Copy link

est_server_http.c changes should use hdrlen, not hdr_len

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants