commit 06dab806ce3245f856618a13a262a2e4e4a19e9f
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Thu Aug 15 12:24:43 2013 +0200
committer Paul Bakker <p.j.bakker@polarssl.org> Fri Aug 16 14:00:52 2013 +0200
tree 93351bcfb2669a8a6766d97771f165f9af55daf8
parent 0b2726732ea2e7cc607c86aa869f9d5636c40c2e

Fix memory error in asn1_get_bitstring_null()

When *len is 0, **p would be read, which is out of bounds.

library/asn1parse.c

diff --git a/library/asn1parse.c b/library/asn1parse.c
index f6b79ef..9d42f05 100644
--- a/library/asn1parse.c
+++ b/library/asn1parse.c
@@ -220,7 +220,7 @@
     if( ( ret = asn1_get_tag( p, end, len, ASN1_BIT_STRING ) ) != 0 )
         return( ret );
 
-    if( --*len < 1 || *(*p)++ != 0 )
+    if( (*len)-- < 2 || *(*p)++ != 0 )
         return( POLARSSL_ERR_ASN1_INVALID_DATA );
 
     return( 0 );

tests/suites/test_suite_x509parse.data

diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data
index bf13719..a44fc06 100644
--- a/tests/suites/test_suite_x509parse.data
+++ b/tests/suites/test_suite_x509parse.data
@@ -520,7 +520,7 @@
 x509parse_crt:"30673065a0030201028204deadbeef300d06092a864886f70d0101020500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374300f300d06092A864886F70D0101010500":"":POLARSSL_ERR_X509_CERT_INVALID_PUBKEY + POLARSSL_ERR_ASN1_OUT_OF_DATA
 
 X509 Certificate ASN1 (TBSCertificate, pubkey, no bitstring data)
-x509parse_crt:"30693067a0030201028204deadbeef300d06092a864886f70d0101020500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a300806001304546573743011300d06092A864886F70D01010105000300":"":POLARSSL_ERR_X509_CERT_INVALID_PUBKEY + POLARSSL_ERR_ASN1_OUT_OF_DATA
+x509parse_crt:"30693067a0030201028204deadbeef300d06092a864886f70d0101020500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a300806001304546573743011300d06092A864886F70D01010105000300":"":POLARSSL_ERR_X509_CERT_INVALID_PUBKEY + POLARSSL_ERR_ASN1_INVALID_DATA
 
 X509 Certificate ASN1 (TBSCertificate, pubkey, invalid bitstring start)
 x509parse_crt:"306a3068a0030201028204deadbeef300d06092a864886f70d0101020500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a300806001304546573743012300d06092A864886F70D0101010500030101":"":POLARSSL_ERR_X509_CERT_INVALID_PUBKEY + POLARSSL_ERR_ASN1_INVALID_DATA