denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added additional sanity checks to asn1_length() parsing

Browse Source
This commit is contained in:
Martin Willi
2009-07-03 09:26:48 +02:00
parent 00fcc0f8f3
commit 90855e965a
1 changed files with 16 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/asn1/asn1.c
+16 -9
View File
@@ -260,25 +260,32 @@ size_t asn1_length(chunk_t *blob)
u_char n; u_char n;
size_t len; size_t len;
/* advance from tag field on to length field */ if (blob->len < 2)
blob->ptr++; {
blob->len--; DBG2("insufficient number of octets to parse ASN.1 length");
return ASN1_INVALID_LENGTH;
}
/* read first octet of length field */ /* read length field, skip tag and length */
n = *blob->ptr++; n = blob->ptr[1];
blob->len--; *blob = chunk_skip(*blob, 2);
if ((n & 0x80) == 0) if ((n & 0x80) == 0)
{/* single length octet */ { /* single length octet */
if (n > blob->len)
{
DBG2("length is larger than remaining blob size");
return ASN1_INVALID_LENGTH;
}
return n; return n;
} }
/* composite length, determine number of length octets */ /* composite length, determine number of length octets */
n &= 0x7f; n &= 0x7f;
if (n > blob->len) if (n == 0 || n > blob->len)
{ {
DBG2("number of length octets is larger than ASN.1 object"); DBG2("number of length octets invalid");
return ASN1_INVALID_LENGTH; return ASN1_INVALID_LENGTH;
} }