Kazuki Yamaguchi 0765e35cba [ruby/openssl] asn1: limit nesting depth in OpenSSL::ASN1.decode ...

Feeding a deeply nested constructed encoding to OpenSSL::ASN1.decode,
.decode_all, or .traverse can cause unbounded recursion and result in
SystemStackError.

Add an explicit nesting depth limit of 200 levels and raise
OpenSSL::ASN1::ASN1Error if it is exceeded. This limit is arbitrary and
currently not configurable, but should be sufficient for any practical
use cases.

Fixes https://hackerone.com/reports/3662125

https://github.com/ruby/openssl/commit/fc753239cc

2026-05-30 09:03:21 +00:00

..

lib

[ruby/openssl] Make OpenSSL::Digest classes Ractor-safe

2026-05-29 08:23:23 +00:00

depend

…

extconf.rb

[ruby/openssl] x509attr: use sk_ASN1_TYPE_new_reserve()

2026-04-29 09:59:46 +00:00

History.md

[ruby/openssl] Merge branch 'maint-4.0'

2026-05-13 15:33:24 +00:00

openssl_missing.h

[ruby/openssl] asn1: use new ASN1_BIT_STRING accessor functions with OpenSSL 4.0

2026-03-31 15:14:53 +00:00

openssl.gemspec

[ruby/openssl] Merge branch 'maint-4.0'

2026-05-13 15:33:24 +00:00

ossl_asn1.c

[ruby/openssl] asn1: limit nesting depth in OpenSSL::ASN1.decode

2026-05-30 09:03:21 +00:00

ossl_asn1.h

…

ossl_bio.c

[ruby/openssl] Fix missing error check on BIO_get_mem_ptr()

2026-02-26 11:35:50 +00:00

ossl_bio.h

…

ossl_bn.c

…

ossl_bn.h

…

ossl_cipher.c

[ruby/openssl] cipher: fix error checks for EVP_CIPHER_CTX_ctrl()

2026-04-29 09:56:18 +00:00

ossl_cipher.h

…

ossl_config.c

…

ossl_config.h

…

ossl_digest.c

…

ossl_digest.h

…

ossl_engine.c

…

ossl_engine.h

…

ossl_hmac.c

…

ossl_hmac.h

…

ossl_kdf.c

[ruby/openssl] kdf: document incompatibility with timeout

2026-05-29 13:07:47 +00:00

ossl_kdf.h

…

ossl_ns_spki.c

…

ossl_ns_spki.h

…

ossl_ocsp.c

[ruby/openssl] Add const qualifiers for OpenSSL 4.0 compatibility

2026-03-31 15:14:53 +00:00

ossl_ocsp.h

…

ossl_pkcs7.c

[ruby/openssl] pkcs7: avoid using strcmp() with Ruby strings

2026-05-29 08:38:50 +00:00

ossl_pkcs7.h

…

ossl_pkcs12.c

[ruby/openssl] pkcs12: add missing error check for d2i_PKCS12_bio()

2026-05-29 08:45:38 +00:00

ossl_pkcs12.h

…

ossl_pkey_dh.c

…

ossl_pkey_dsa.c

…

ossl_pkey_ec.c

…

ossl_pkey_rsa.c

…

ossl_pkey.c

[ruby/openssl] pkey: fix memory leak when derived key is too large

2026-04-17 16:56:12 +00:00

ossl_pkey.h

[ruby/openssl] pkey: remove unnecessary prototype from ossl_pkey.h

2026-03-31 15:14:53 +00:00

ossl_provider.c

…

ossl_provider.h

…

ossl_rand.c

…

ossl_rand.h

…

ossl_ssl_session.c

…

ossl_ssl.c

[ruby/openssl] Document syswrite_nonblock opts and symbol return value

2026-05-22 10:38:14 +00:00

ossl_ssl.h

…

ossl_ts.c

[ruby/openssl] ts: do not use the "reuse" behavior of d2i_*{,_bio}() functions

2026-05-29 08:45:38 +00:00

ossl_ts.h

…

ossl_x509.c

…

ossl_x509.h

[ruby/openssl] Add const qualifiers for OpenSSL 4.0 compatibility

2026-03-31 15:14:53 +00:00

ossl_x509attr.c

[ruby/openssl] x509attr: use sk_ASN1_TYPE_new_reserve()

2026-04-29 09:59:46 +00:00

ossl_x509cert.c

[ruby/openssl] x509cert: check for error of X509_set_serialNumber()

2026-04-20 09:55:38 +00:00

ossl_x509crl.c

[ruby/openssl] Add const qualifiers for OpenSSL 4.0 compatibility

2026-03-31 15:14:53 +00:00

ossl_x509ext.c

[ruby/openssl] Add const qualifiers for OpenSSL 4.0 compatibility

2026-03-31 15:14:53 +00:00

ossl_x509name.c

[ruby/openssl] x509name: check for error of X509_NAME_cmp()

2026-04-20 09:44:36 +00:00

ossl_x509req.c

[ruby/openssl] Add const qualifiers for OpenSSL 4.0 compatibility

2026-03-31 15:14:53 +00:00

ossl_x509revoked.c

[ruby/openssl] Add const qualifiers for OpenSSL 4.0 compatibility

2026-03-31 15:14:53 +00:00

ossl_x509store.c

[ruby/openssl] x509store, ssl: check for error of CRYPTO_set_ex_data()

2026-04-20 10:31:10 +00:00

ossl.c

[ruby/openssl] Fix potential UAF in ossl_crypto_fixed_length_secure_compare

2026-03-27 07:09:03 +00:00

ossl.h

…