diff options
| author | Stef Walter <stefw@gnome.org> | 2012-11-05 21:24:31 +0100 |
|---|---|---|
| committer | Stef Walter <stefw@gnome.org> | 2012-11-07 23:14:17 +0100 |
| commit | 2e11e75e3bcf0e47709959e0eae8c4a8aa295480 (patch) | |
| tree | f0b426872a5e9a9236b76c1c1e939be4fbf52a13 /egg/egg-asn1x.c | |
| parent | b271623e5c3044099fdbae8e6037fd23e3eee5e9 (diff) | |
| download | gcr-2e11e75e3bcf0e47709959e0eae8c4a8aa295480.tar.gz | |
egg-asn1x: Fix crash when parsing invalid DER files
* When parsing invalid DER files and more than one sub-TLV is
encountered we would do a NULL dereference.
* Catch this condition and test for it.
Diffstat (limited to 'egg/egg-asn1x.c')
| -rw-r--r-- | egg/egg-asn1x.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/egg/egg-asn1x.c b/egg/egg-asn1x.c index 5168e3f..7e6e854 100644 --- a/egg/egg-asn1x.c +++ b/egg/egg-asn1x.c @@ -1181,11 +1181,17 @@ static gboolean anode_decode_anything (GNode *node, Atlv *tlv) { + GNode *prev = NULL; GNode *next; gulong tag; gint flags; + g_assert (node != NULL); + while (tlv != NULL) { + if (node == NULL) + return anode_failure (prev, "encountered extra tag"); + flags = anode_def_flags (node); tag = anode_calc_tag_for_flags (node, flags); @@ -1205,6 +1211,7 @@ anode_decode_anything (GNode *node, if (next == NULL) return anode_failure (node, "decoded tag did not match expected"); + prev = node; node = next; continue; } @@ -1213,6 +1220,7 @@ anode_decode_anything (GNode *node, return FALSE; /* Next node and tag */ + prev = node; node = g_node_next_sibling (node); tlv = tlv->next; } |