From 502fa1453649154f81bd76d03e75d74646d2ea78 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 22 Jun 2026 19:02:28 +0200 Subject: [PATCH] asn1: Reject OIDs with too large sub-identifiers when converting to string The shift would overflow the value which could produce garbage output that might get interpreted as real OIDs (in case strings are compared). This limit allows OID sub-identifiers to consist of at most 4 bytes, which should be enough for any real-world OIDs (it's also the maximum we used in tests so far). Fixes: f813069e895e ("fixed asn1_oid_to_string() conversion") --- src/libstrongswan/asn1/asn1.c | 8 ++++++-- src/libstrongswan/tests/suites/test_asn1.c | 1 + 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c index 866b3c857..a08ae5aff 100644 --- a/src/libstrongswan/asn1/asn1.c +++ b/src/libstrongswan/asn1/asn1.c @@ -203,7 +203,7 @@ char *asn1_oid_to_string(chunk_t oid) size_t len = 64; char buf[len], *pos = buf; int written; - u_int val; + uint32_t val; if (!oid.len) { @@ -222,7 +222,11 @@ char *asn1_oid_to_string(chunk_t oid) while (oid.len) { - val = (val << 7) + (u_int)(oid.ptr[0] & 0x7f); + if (val > (UINT32_MAX >> 7)) + { + return NULL; + } + val = (val << 7) + (uint32_t)(oid.ptr[0] & 0x7f); if (oid.ptr[0] < 128) { diff --git a/src/libstrongswan/tests/suites/test_asn1.c b/src/libstrongswan/tests/suites/test_asn1.c index fc207355d..03a230ae2 100644 --- a/src/libstrongswan/tests/suites/test_asn1.c +++ b/src/libstrongswan/tests/suites/test_asn1.c @@ -253,6 +253,7 @@ START_TEST(test_asn1_oid_to_string) chunk_from_chars( 0x0a, 0x64, 0x87, 0x68, 0xce, 0x10, 0x86, 0x8d, 0x20, 0xbd, 0x84, 0x40, 0x84, 0xe2, 0xad, 0x00, 0xaf, 0xd7, 0xc2, 0x00, 0xff, 0xff, 0xff, 0x7f) }, + { NULL, chunk_from_chars( 0x00, 0xff, 0xff, 0xff, 0xff, 0x7f) }, { NULL, chunk_from_chars( 0x0a, 0x02, 0x64, 0x87, 0x68, 0xce, 0x10, 0x86, 0x8d, 0x20, 0xbd, 0x84, 0x40, 0x84, 0xe2, 0xad, 0x00, 0xaf, 0xd7, 0xc2, 0x00,