You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
72 lines
3.1 KiB
72 lines
3.1 KiB
4 years ago
|
diff --git a/src/lib/krb5/asn.1/asn1_encode.c b/src/lib/krb5/asn.1/asn1_encode.c
|
||
|
|
index a160cf4fe8..cd6b879f77 100644
|
||
|
|
--- a/lib/krb5/asn.1/asn1_encode.c
|
||
|
|
+++ b/lib/krb5/asn.1/asn1_encode.c
|
||
|
|
@@ -356,7 +356,7 @@ make_tag(asn1buf *buf, const taginfo *t, size_t len)
|
||
|
|
static krb5_error_code
|
||
|
|
get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
|
||
|
|
const uint8_t **contents_out, size_t *clen_out,
|
||
|
|
- const uint8_t **remainder_out, size_t *rlen_out)
|
||
|
|
+ const uint8_t **remainder_out, size_t *rlen_out, int recursion)
|
||
|
|
{
|
||
|
|
krb5_error_code ret;
|
||
|
|
uint8_t o;
|
||
|
|
@@ -394,9 +394,11 @@ get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
|
||
|
|
/* Indefinite form (should not be present in DER, but we accept it). */
|
||
|
|
if (tag_out->construction != CONSTRUCTED)
|
||
|
|
return ASN1_MISMATCH_INDEF;
|
||
|
|
+ if (recursion >= 32)
|
||
|
|
+ return ASN1_OVERFLOW;
|
||
|
|
p = asn1;
|
||
|
|
while (!(len >= 2 && p[0] == 0 && p[1] == 0)) {
|
||
|
|
- ret = get_tag(p, len, &t, &c, &clen, &p, &len);
|
||
|
|
+ ret = get_tag(p, len, &t, &c, &clen, &p, &len, recursion + 1);
|
||
|
|
if (ret)
|
||
|
|
return ret;
|
||
|
|
}
|
||
|
|
@@ -613,7 +615,7 @@ split_der(asn1buf *buf, uint8_t *const *der, size_t len, taginfo *tag_out)
|
||
|
|
const uint8_t *contents, *remainder;
|
||
|
|
size_t clen, rlen;
|
||
|
|
|
||
|
|
- ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen);
|
||
|
|
+ ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen, 0);
|
||
|
|
if (ret)
|
||
|
|
return ret;
|
||
|
|
if (rlen != 0)
|
||
|
|
@@ -1199,7 +1201,7 @@ decode_atype(const taginfo *t, const uint8_t *asn1, size_t len,
|
||
|
|
const uint8_t *rem;
|
||
|
|
size_t rlen;
|
||
|
|
if (!tag->implicit) {
|
||
|
|
- ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen);
|
||
|
|
+ ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen, 0);
|
||
|
|
if (ret)
|
||
|
|
return ret;
|
||
|
|
/* Note: we don't check rlen (it should be 0). */
|
||
|
|
@@ -1420,7 +1422,7 @@ decode_sequence(const uint8_t *asn1, size_t len, const struct seq_info *seq,
|
||
|
|
for (i = 0; i < seq->n_fields; i++) {
|
||
|
|
if (len == 0)
|
||
|
|
break;
|
||
|
|
- ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
|
||
|
|
+ ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
|
||
|
|
if (ret)
|
||
|
|
goto error;
|
||
|
|
/*
|
||
|
|
@@ -1478,7 +1480,7 @@ decode_sequence_of(const uint8_t *asn1, size_t len,
|
||
|
|
*seq_out = NULL;
|
||
|
|
*count_out = 0;
|
||
|
|
while (len > 0) {
|
||
|
|
- ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
|
||
|
|
+ ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
|
||
|
|
if (ret)
|
||
|
|
goto error;
|
||
|
|
if (!check_atype_tag(elemtype, &t)) {
|
||
|
|
@@ -1584,7 +1586,7 @@ k5_asn1_full_decode(const krb5_data *code, const struct atype_info *a,
|
||
|
|
|
||
|
|
*retrep = NULL;
|
||
|
|
ret = get_tag((uint8_t *)code->data, code->length, &t, &contents,
|
||
|
|
- &clen, &remainder, &rlen);
|
||
|
|
+ &clen, &remainder, &rlen, 0);
|
||
|
|
if (ret)
|
||
|
|
return ret;
|
||
|
|
/* rlen should be 0, but we don't check it (and due to padding in
|