Commit 674341f1 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson Committed by Matt Caswell
Browse files

Free up ADB and CHOICE if already initialised. 



CVE-2015-0287

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>
parent c58f4f73

crypto/asn1/tasn_dec.c

+21 −3
Original line number Diff line number Diff line
@@ -302,9 +302,16 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, 
    case ASN1_ITYPE_CHOICE:

        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))

            goto auxerr;



        /* Allocate structure */

        if (!*pval && !ASN1_item_ex_new(pval, it)) {

        if (*pval) {

            /* Free up and zero CHOICE value if initialised */

            i = asn1_get_choice_selector(pval, it);

            if ((i >= 0) && (i < it->tcount)) {

                tt = it->templates + i;

                pchptr = asn1_get_field_ptr(pval, tt);

                ASN1_template_free(pchptr, tt);

                asn1_set_choice_selector(pval, -1, it);

            }

        } else if (!ASN1_item_ex_new(pval, it)) {

            ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);

            goto err;

        }
@@ -384,6 +391,17 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, 
        if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))

            goto auxerr;



        /* Free up and zero any ADB found */

        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {

            if (tt->flags & ASN1_TFLG_ADB_MASK) {

                const ASN1_TEMPLATE *seqtt;

                ASN1_VALUE **pseqval;

                seqtt = asn1_do_adb(pval, tt, 1);

                pseqval = asn1_get_field_ptr(pval, seqtt);

                ASN1_template_free(pseqval, seqtt);

            }

        }



        /* Get each field entry */

        for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {

            const ASN1_TEMPLATE *seqtt;