Check for overflows in ASN1_object_size(). (e9f17097) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

crypto/asn1/asn1_lib.c

+16 −12

Original line number	Original line	Diff line number	Diff line
	@@ -206,26 +206,30 @@ static void asn1_put_length(unsigned char **pp, int length)

	int ASN1_object_size(int constructed, int length, int tag)		int ASN1_object_size(int constructed, int length, int tag)
	{		{
	int ret;		int ret = 1;
			if (length < 0)
	ret = length;		return -1;
	ret++;
	if (tag >= 31) {		if (tag >= 31) {
	while (tag > 0) {		while (tag > 0) {
	tag >>= 7;		tag >>= 7;
	ret++;		ret++;
	}		}
	}		}
	if (constructed == 2)		if (constructed == 2) {
	return ret + 3;		ret += 3;
			} else {
	ret++;		ret++;
	if (length > 127) {		if (length > 127) {
	while (length > 0) {		int tmplen = length;
	length >>= 8;		while (tmplen > 0) {
			tmplen >>= 8;
	ret++;		ret++;
	}		}
	}		}
	return (ret);		}
			if (ret >= INT_MAX - length)
			return -1;
			return ret + length;
	}		}

	int ASN1_STRING_copy(ASN1_STRING dst, const ASN1_STRING str)		int ASN1_STRING_copy(ASN1_STRING dst, const ASN1_STRING str)