commit 6978949cd090a6301466fdc709b1830429254053
author k-stachowiak <krzysiek.stachowiak@gmail.com> Mon Jul 16 10:49:12 2018 +0200
committer k-stachowiak <krzysiek.stachowiak@gmail.com> Mon Jul 16 12:30:39 2018 +0200
tree 0414464ecfe17792044d03dbfe248a1e43af8a07
parent a063fff51a366a15f9bc42e6bdf5f1c20022fcc4

Prevent buffer overread by one byte

library/x509_crt.c

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 6751da0..85fee84 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -558,18 +558,14 @@
         end_ext_data = *p + len;
 
         /* Get extension ID */
-        extn_oid.tag = **p;
-
-        if( ( ret = mbedtls_asn1_get_tag( p, end, &extn_oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
+        if( ( ret = mbedtls_asn1_get_tag( p, end_ext_data, &extn_oid.len,
+				  MBEDTLS_ASN1_OID ) ) != 0 )
             return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret );
 
+        extn_oid.tag = MBEDTLS_ASN1_OID;
         extn_oid.p = *p;
         *p += extn_oid.len;
 
-        if( ( end - *p ) < 1 )
-            return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
-                    MBEDTLS_ERR_ASN1_OUT_OF_DATA );
-
         /* Get optional critical */
         if( ( ret = mbedtls_asn1_get_bool( p, end_ext_data, &is_critical ) ) != 0 &&
             ( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) )