Don't use chunk_skip() in asn1_length().
chunk_skip() returns chunk_empty if the length of the chunk is equal to the number of bytes to skip, this is problematic as asn1_length() modifies the original chunk. asn1_parser_t for instance uses the modified chunk to later calculate the length of the resulting ASN.1 object which produces incorrect results if it is based on chunk_empty.
This commit is contained in:
@@ -228,7 +228,8 @@ size_t asn1_length(chunk_t *blob)
|
|||||||
|
|
||||||
/* read length field, skip tag and length */
|
/* read length field, skip tag and length */
|
||||||
n = blob->ptr[1];
|
n = blob->ptr[1];
|
||||||
*blob = chunk_skip(*blob, 2);
|
blob->ptr += 2;
|
||||||
|
blob->len -= 2;
|
||||||
|
|
||||||
if ((n & 0x80) == 0)
|
if ((n & 0x80) == 0)
|
||||||
{ /* single length octet */
|
{ /* single length octet */
|
||||||
|
|||||||
Reference in New Issue
Block a user