CVE-2025-23134_fixes_code

CVE-2026-34180 – Patch Changes

The patch addresses an integer truncation issue in the OpenSSL ASN.1/DER decoding code.

The following changes were made:

1. Updated the ASN.1 content length type

   • Changed the len parameter of asn1_ex_c2i() from int to long.
   • This allows the function to receive and handle large ASN.1 content lengths without immediately truncating them to a 32-bit integer.

2. Added length truncation validation

   • Introduced an ilen variable to hold the int representation of len.
   • Added a check to verify that the original long length can safely fit into an int.
   • If the length is too large, the function returns an ASN.1 TOO_LONG error instead of continuing with an incorrect truncated length.

3. Updated primitive conversion handling

   • The prim_c2i() callback is now called only when the length can safely be represented as an int.
   • This prevents an oversized ASN.1 length from being passed to functions that expect an int.

4. Updated ASN.1 object conversion

   • Added the same length validation before calling ossl_c2i_ASN1_OBJECT().

5. Updated ASN.1 string handling

   • Changed ASN1_STRING_set0() and ASN1_STRING_set() to use the validated ilen value instead of the original potentially oversized len.

Purpose of the Fix

These changes prevent an attacker-controlled ASN.1 length greater than the supported int range from being silently truncated and subsequently used for buffer operations. This prevents incorrect length calculations and mitigates the heap buffer over-read condition associated with CVE-2026-34180.