diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c index 866b3c857..a08ae5aff 100644 --- a/src/libstrongswan/asn1/asn1.c +++ b/src/libstrongswan/asn1/asn1.c @@ -203,7 +203,7 @@ char *asn1_oid_to_string(chunk_t oid) size_t len = 64; char buf[len], *pos = buf; int written; - u_int val; + uint32_t val; if (!oid.len) { @@ -222,7 +222,11 @@ char *asn1_oid_to_string(chunk_t oid) while (oid.len) { - val = (val << 7) + (u_int)(oid.ptr[0] & 0x7f); + if (val > (UINT32_MAX >> 7)) + { + return NULL; + } + val = (val << 7) + (uint32_t)(oid.ptr[0] & 0x7f); if (oid.ptr[0] < 128) { diff --git a/src/libstrongswan/tests/suites/test_asn1.c b/src/libstrongswan/tests/suites/test_asn1.c index fc207355d..03a230ae2 100644 --- a/src/libstrongswan/tests/suites/test_asn1.c +++ b/src/libstrongswan/tests/suites/test_asn1.c @@ -253,6 +253,7 @@ START_TEST(test_asn1_oid_to_string) chunk_from_chars( 0x0a, 0x64, 0x87, 0x68, 0xce, 0x10, 0x86, 0x8d, 0x20, 0xbd, 0x84, 0x40, 0x84, 0xe2, 0xad, 0x00, 0xaf, 0xd7, 0xc2, 0x00, 0xff, 0xff, 0xff, 0x7f) }, + { NULL, chunk_from_chars( 0x00, 0xff, 0xff, 0xff, 0xff, 0x7f) }, { NULL, chunk_from_chars( 0x0a, 0x02, 0x64, 0x87, 0x68, 0xce, 0x10, 0x86, 0x8d, 0x20, 0xbd, 0x84, 0x40, 0x84, 0xe2, 0xad, 0x00, 0xaf, 0xd7, 0xc2, 0x00,