Fix buffer handling of OBJ_obj2txt

[tiran]

BPO	30502
Nosy	@tiran, @serhiy-storchaka
PRs	bpo-30502: Fix handling of long oids #1852 bpo-30502: Fix handling of long oids in ssl. #2909 [3.6] bpo-30502: Fix handling of long oids in ssl. (GH-2909) #3321 [2.7] bpo-30502: Fix handling of long oids in ssl. (GH-2909). #3322
Files	issue30502-simpler.diff

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2017-09-05.22:38:14.631>
created_at = <Date 2017-05-29.07:19:13.843>
labels = ['expert-SSL', 'type-bug', '3.7']
title = 'Fix buffer handling of OBJ_obj2txt'
updated_at = <Date 2017-09-05.22:38:14.630>
user = 'https://github.com/tiran'

bugs.python.org fields:

activity = <Date 2017-09-05.22:38:14.630>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2017-09-05.22:38:14.631>
closer = 'christian.heimes'
components = ['SSL']
creation = <Date 2017-05-29.07:19:13.843>
creator = 'christian.heimes'
dependencies = []
files = ['46909']
hgrepos = []
issue_num = 30502
keywords = ['patch']
message_count = 7.0
messages = ['294679', '294684', '294687', '294690', '301276', '301337', '301338']
nosy_count = 2.0
nosy_names = ['christian.heimes', 'serhiy.storchaka']
pr_nums = ['1852', '2909', '3321', '3322']
priority = 'critical'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue30502'
versions = ['Python 2.7', 'Python 3.6', 'Python 3.7']

[tiran]

Frawser Tweedle from Red Hat's identity management team found an issue in PyCA cryptography's handling of buffers for OpenSSL OBJ_obj2txt(). Cryptography fails to handle long OIDs as used by Active Directory.

pyca/cryptography#3612
https://bugzilla.redhat.com/show_bug.cgi?id=1455755

CPython's ssl module doesn't handle buffer allocation for OBJ_obj2txt() correctly, too. A default buffer size of 255+1 makes the bug less likely to occur, though. We should fix the problem anyway.

[serhiy-storchaka]

Can the common code of _create_tuple_for_attribute() and asn1obj2py() be shared?

[tiran]

IMO it doesn't make sense to share a couple of lines of code. It makes the code even harder to read.

[serhiy-storchaka]

Your PR LGTM. But I think the code can be much simpler.

Here is a patch that shares common code and applies other simplifications to surrounded code. PR 1852 increases the total number of lines by 37 lines, bpo-30502-simpler.diff -- only by 3 lines.

PR 1852: 1 file changed, 49 insertions(+), 12 deletions(-)
bpo-30502-simpler.diff: 1 file changed, 46 insertions(+), 43 deletions(-)

[tiran]

New changeset e503ca5 by Christian Heimes (Serhiy Storchaka) in branch 'master':
bpo-30502: Fix handling of long oids in ssl. (bpo-2909)
e503ca5

[tiran]

New changeset f201e88 by Christian Heimes in branch '3.6':
[3.6] bpo-30502: Fix handling of long oids in ssl. (GH-2909) (bpo-3321)
f201e88

[tiran]

New changeset c9d668c by Christian Heimes in branch '2.7':
[2.7] bpo-30502: Fix handling of long oids in ssl. (GH-2909). (bpo-3322)
c9d668c