diff options
| author | Kurt Roeckx <kurt@roeckx.be> | 2014-12-15 17:15:16 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2015-01-05 15:23:42 +0000 |
| commit | 7fae32f6d69baf27ef69d92499c59c8a3277f3e3 (patch) | |
| tree | 1b24421ba2f6f3f8eaa98ca9d564ac590bbd4175 | |
| parent | 5260f1a483d453ecf7aec9d1ec4be96432eec4d3 (diff) | |
Return error when a bit string indicates an invalid amount of bits left
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 86edf13b1c97526c0cf63c37342aaa01f5442688)
| -rw-r--r-- | crypto/asn1/a_bitstr.c | 7 | ||||
| -rw-r--r-- | crypto/asn1/asn1.h | 1 | ||||
| -rw-r--r-- | crypto/asn1/asn1_err.c | 1 |
3 files changed, 8 insertions, 1 deletions
diff --git a/crypto/asn1/a_bitstr.c b/crypto/asn1/a_bitstr.c index 0fb9ce0c2a..665fc09a1d 100644 --- a/crypto/asn1/a_bitstr.c +++ b/crypto/asn1/a_bitstr.c @@ -136,11 +136,16 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, p= *pp; i= *(p++); + if (i > 7) + { + i=ASN1_R_INVALID_BIT_STRING_BITS_LEFT; + goto err; + } /* We do this to preserve the settings. If we modify * the settings, via the _set_bit function, we will recalculate * on output */ ret->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear */ - ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|(i&0x07)); /* set */ + ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|i); /* set */ if (len-- > 1) /* using one because of the bits left byte */ { diff --git a/crypto/asn1/asn1.h b/crypto/asn1/asn1.h index 4add41e741..aeb3f4c1b4 100644 --- a/crypto/asn1/asn1.h +++ b/crypto/asn1/asn1.h @@ -1260,6 +1260,7 @@ void ERR_load_ASN1_strings(void); #define ASN1_R_ILLEGAL_TIME_VALUE 184 #define ASN1_R_INTEGER_NOT_ASCII_FORMAT 185 #define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG 128 +#define ASN1_R_INVALID_BIT_STRING_BITS_LEFT 220 #define ASN1_R_INVALID_BMPSTRING_LENGTH 129 #define ASN1_R_INVALID_DIGIT 130 #define ASN1_R_INVALID_MIME_TYPE 200 diff --git a/crypto/asn1/asn1_err.c b/crypto/asn1/asn1_err.c index afe037d7e9..92b4f8f100 100644 --- a/crypto/asn1/asn1_err.c +++ b/crypto/asn1/asn1_err.c @@ -235,6 +235,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]= {ERR_REASON(ASN1_R_ILLEGAL_TIME_VALUE) ,"illegal time value"}, {ERR_REASON(ASN1_R_INTEGER_NOT_ASCII_FORMAT),"integer not ascii format"}, {ERR_REASON(ASN1_R_INTEGER_TOO_LARGE_FOR_LONG),"integer too large for long"}, +{ERR_REASON(ASN1_R_INVALID_BIT_STRING_BITS_LEFT),"invalid bit string bits left"}, {ERR_REASON(ASN1_R_INVALID_BMPSTRING_LENGTH),"invalid bmpstring length"}, {ERR_REASON(ASN1_R_INVALID_DIGIT) ,"invalid digit"}, {ERR_REASON(ASN1_R_INVALID_MIME_TYPE) ,"invalid mime type"}, |