| commit | 06dab806ce3245f856618a13a262a2e4e4a19e9f | [log] [tgz] |
|---|---|---|
| author | Manuel Pégourié-Gonnard <mpg@elzevir.fr> | Thu Aug 15 12:24:43 2013 +0200 |
| committer | Paul Bakker <p.j.bakker@polarssl.org> | Fri Aug 16 14:00:52 2013 +0200 |
| tree | 93351bcfb2669a8a6766d97771f165f9af55daf8 | |
| parent | 0b2726732ea2e7cc607c86aa869f9d5636c40c2e [diff] [blame] |
Fix memory error in asn1_get_bitstring_null() When *len is 0, **p would be read, which is out of bounds.
diff --git a/library/asn1parse.c b/library/asn1parse.c index f6b79ef..9d42f05 100644 --- a/library/asn1parse.c +++ b/library/asn1parse.c
@@ -220,7 +220,7 @@ if( ( ret = asn1_get_tag( p, end, len, ASN1_BIT_STRING ) ) != 0 ) return( ret ); - if( --*len < 1 || *(*p)++ != 0 ) + if( (*len)-- < 2 || *(*p)++ != 0 ) return( POLARSSL_ERR_ASN1_INVALID_DATA ); return( 0 );