diff options
| author |   jsing <jsing@openbsd.org> | 2018-05-12 17:39:05 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2018-05-12 17:39:05 +0000 |
| commit | 97c9d8a58a77402ddb70d45d40f92b03b260960e (patch) | |
| tree | 551dda894bce29efc62fbc3814ffe2c3f3f29c00 /lib/libcrypto/asn1/a_bitstr.c | |
| parent | Use explicit_bzero() rather than memset() when clearing a BIGNUM. (diff) | |
| download | wireguard-openbsd-97c9d8a58a77402ddb70d45d40f92b03b260960e.tar.xz wireguard-openbsd-97c9d8a58a77402ddb70d45d40f92b03b260960e.zip | |
Add a missing bounds check in c2i_ASN1_BIT_STRING().
This could potentially result in a left shift that exceeded the size of the
storage type.
Issue found by Simon Friedberger, Robert Merget and Juraj Somorovsky.
ok inoguchi@ tb@
Diffstat (limited to 'lib/libcrypto/asn1/a_bitstr.c')
| -rw-r--r-- | lib/libcrypto/asn1/a_bitstr.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/lib/libcrypto/asn1/a_bitstr.c b/lib/libcrypto/asn1/a_bitstr.c index 8a4a68dbb31..3800c218a18 100644 --- a/lib/libcrypto/asn1/a_bitstr.c +++ b/lib/libcrypto/asn1/a_bitstr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: a_bitstr.c,v 1.25 2018/04/25 11:48:21 tb Exp $ */ +/* $OpenBSD: a_bitstr.c,v 1.26 2018/05/12 17:39:05 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -147,6 +147,11 @@ c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, const unsigned char **pp, long len) p = *pp; i = *(p++); + if (i > 7) { + ASN1error(ASN1_R_INVALID_BIT_STRING_BITS_LEFT); + goto err; + } + /* We do this to preserve the settings. If we modify * the settings, via the _set_bit function, we will recalculate * on output */ |