encode_ber_digest_info: added sanity check

Issue found using oss-fuzz:
 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15665

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

2 files changed, 4 insertions, 0 deletions

diff --git a/fuzz/gnutls_x509_verify_fuzzer.repro/5b24d9a0bdb049a203a1fac98d2854bbc6062195 b/fuzz/gnutls_x509_verify_fuzzer.repro/5b24d9a0bdb049a203a1fac98d2854bbc6062195
new file mode 100644
index 0000000000..86b66c022c
--- /dev/null
+++ b/fuzz/gnutls_x509_verify_fuzzer.repro/5b24d9a0bdb049a203a1fac98d2854bbc6062195
diff --git a/lib/pk.c b/lib/pk.c
index 1887063eb0..debcc2ac09 100644
--- a/lib/pk.c
+++ b/lib/pk.c
@@ -598,6 +598,10 @@ encode_ber_digest_info(const mac_entry_st * e,
 	uint8_t *tmp_output;
 	int tmp_output_size;
 
+	/* prevent asn1_write_value() treating input as string */
+	if (digest->size == 0)
+		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+
 	algo = _gnutls_x509_mac_to_oid(e);
 	if (algo == NULL) {
 		gnutls_assert();