Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe9dc22a authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "KEYS: Fix ASN.1 indefinite length object parsing"

parents 9ab222a3 ba22ea52

lib/asn1_decoder.c

+9 −7
Original line number Diff line number Diff line
@@ -74,7 +74,7 @@ next_tag: 


	/* Extract a tag from the data */

	tag = data[dp++];

	if (tag == 0) {

	if (tag == ASN1_EOC) {

		/* It appears to be an EOC. */

		if (data[dp++] != 0)

			goto invalid_eoc;
@@ -96,10 +96,8 @@ next_tag: 


	/* Extract the length */

	len = data[dp++];

	if (len <= 0x7f) {

		dp += len;

		goto next_tag;

	}

	if (len <= 0x7f)

		goto check_length;



	if (unlikely(len == ASN1_INDEFINITE_LENGTH)) {

		/* Indefinite length */
@@ -110,14 +108,18 @@ next_tag: 
	}



	n = len - 0x80;

	if (unlikely(n > sizeof(size_t) - 1))

	if (unlikely(n > sizeof(len) - 1))

		goto length_too_long;

	if (unlikely(n > datalen - dp))

		goto data_overrun_error;

	for (len = 0; n > 0; n--) {

	len = 0;

	for (; n > 0; n--) {

		len <<= 8;

		len |= data[dp++];

	}

check_length:

	if (len > datalen - dp)

		goto data_overrun_error;

	dp += len;

	goto next_tag;