Commit e9f17097 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Check for overflows in ASN1_object_size(). 



Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
parent f37c159a

crypto/asn1/asn1_lib.c

+16 −12
Original line number Diff line number Diff line
@@ -206,26 +206,30 @@ static void asn1_put_length(unsigned char **pp, int length) 


int ASN1_object_size(int constructed, int length, int tag)

{

    int ret;



    ret = length;

    ret++;

    int ret = 1;

    if (length < 0)

        return -1;

    if (tag >= 31) {

        while (tag > 0) {

            tag >>= 7;

            ret++;

        }

    }

    if (constructed == 2)

        return ret + 3;

    if (constructed == 2) {

        ret += 3;

    } else {

        ret++;

        if (length > 127) {

        while (length > 0) {

            length >>= 8;

            int tmplen = length;

            while (tmplen > 0) {

                tmplen >>= 8;

                ret++;

            }

        }

    return (ret);

    }

    if (ret >= INT_MAX - length)

        return -1;

    return ret + length;

}



int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)