Don't use chunk_skip() in asn1_length().
chunk_skip() returns chunk_empty if the length of the chunk is equal to the number of bytes to skip, this is problematic as asn1_length() modifies the original chunk. asn1_parser_t for instance uses the modified chunk to later calculate the length of the resulting ASN.1 object which produces incorrect results if it is based on chunk_empty.
This commit is contained in:
@@ -228,7 +228,8 @@ size_t asn1_length(chunk_t *blob)
|
||||
|
||||
/* read length field, skip tag and length */
|
||||
n = blob->ptr[1];
|
||||
*blob = chunk_skip(*blob, 2);
|
||||
blob->ptr += 2;
|
||||
blob->len -= 2;
|
||||
|
||||
if ((n & 0x80) == 0)
|
||||
{ /* single length octet */
|
||||
|
||||
Reference in New Issue
Block a user