updated libtasn1

1 files changed, 79 insertions, 66 deletions

diff --git a/lib/minitasn1/decoding.c b/lib/minitasn1/decoding.c
index 968fa96bfd..1cfad3556b 100644
--- a/lib/minitasn1/decoding.c
+++ b/lib/minitasn1/decoding.c
@@ -30,6 +30,7 @@
 #include <gstr.h>
 #include "structure.h"
 #include "element.h"
+#include <limits.h>
 
 static asn1_retCode
 _asn1_get_indefinite_length_string (const unsigned char *der, int *len);
@@ -60,8 +61,8 @@ _asn1_error_description_tag_error (ASN1_TYPE node, char *ErrorDescription)
 signed long
 asn1_get_length_der (const unsigned char *der, int der_len, int *len)
 {
-  int ans;
-  int k, punt;
+  unsigned int ans, sum, last;
+  unsigned int k, punt;
 
   *len = 0;
   if (der_len <= 0)
@@ -71,7 +72,7 @@ asn1_get_length_der (const unsigned char *der, int der_len, int *len)
     {
       /* short form */
       *len = 1;
-      return der[0];
+      ans = der[0];
     }
   else
     {
@@ -83,10 +84,10 @@ asn1_get_length_der (const unsigned char *der, int der_len, int *len)
 	  ans = 0;
 	  while (punt <= k && punt < der_len)
 	    {
-	      int last = ans;
+	      last = ans;
 
-	      ans = ans * 256 + der[punt++];
-	      if (ans < last)
+	      ans = (ans*256) + der[punt++];
+	      if (ans < last) 
 		/* we wrapped around, no bignum support... */
 		return -2;
 	    }
@@ -98,10 +99,19 @@ asn1_get_length_der (const unsigned char *der, int der_len, int *len)
 	}
 
       *len = punt;
-      if (ans + *len < ans || ans + *len > der_len)
-	return -4;
-      return ans;
     }
+
+  sum = ans + *len;
+  
+  /* check for overflow as well INT_MAX as a maximum upper
+   * limit for length */
+  if (sum >= INT_MAX || sum < ans)
+    return -2;
+  
+  if (sum > der_len)
+    return -4;
+
+  return ans;
 }
 
 /**
@@ -120,7 +130,8 @@ int
 asn1_get_tag_der (const unsigned char *der, int der_len,
 		  unsigned char *cls, int *len, unsigned long *tag)
 {
-  int punt, ris;
+  unsigned int punt, ris;
+  unsigned int last;
 
   if (der == NULL || der_len < 2 || len == NULL)
     return ASN1_DER_ERROR;
@@ -139,21 +150,23 @@ asn1_get_tag_der (const unsigned char *der, int der_len,
       ris = 0;
       while (punt <= der_len && der[punt] & 128)
 	{
-	  int last = ris;
-	  ris = ris * 128 + (der[punt++] & 0x7F);
+	  last = ris;
+
+	  ris = (ris * 128) + (der[punt++] & 0x7F);
 	  if (ris < last)
-	    /* wrapper around, and no bignums... */
+	    /* wrapped around, and no bignums... */
 	    return ASN1_DER_ERROR;
 	}
+
       if (punt >= der_len)
 	return ASN1_DER_ERROR;
-      {
-	int last = ris;
-	ris = ris * 128 + (der[punt++] & 0x7F);
-	if (ris < last)
-	  /* wrapper around, and no bignums... */
-	  return ASN1_DER_ERROR;
-      }
+
+      last = ris;
+        
+      ris = (ris * 128) + (der[punt++] & 0x7F);
+      if (ris < last)
+        return ASN1_DER_ERROR;
+
       *len = punt;
     }
   if (tag)
@@ -1031,10 +1044,10 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 	      len2 =
 		asn1_get_length_der (der + counter, len - counter, &len3);
 	      if (len2 < 0)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      _asn1_set_value (p, der + counter, len3 + len2);
 	      counter += len3 + len2;
@@ -1045,7 +1058,7 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 		_asn1_get_objectid_der (der + counter, len - counter, &len2,
 					temp, sizeof (temp));
 	      if (result != ASN1_SUCCESS)
-                goto cleanup;
+		goto cleanup;
 
 	      tlen = strlen (temp);
 	      if (tlen > 0)
@@ -1070,7 +1083,7 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 	      len3 = len - counter;
 	      result = _asn1_get_octet_string (der + counter, p, &len3);
 	      if (result != ASN1_SUCCESS)
-                goto cleanup;
+		goto cleanup;
 
 	      counter += len3;
 	      move = RIGHT;
@@ -1079,10 +1092,10 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 	      len2 =
 		asn1_get_length_der (der + counter, len - counter, &len3);
 	      if (len2 < 0)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      _asn1_set_value (p, der + counter, len3 + len2);
 	      counter += len3 + len2;
@@ -1092,10 +1105,10 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 	      len2 =
 		asn1_get_length_der (der + counter, len - counter, &len3);
 	      if (len2 < 0)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      _asn1_set_value (p, der + counter, len3 + len2);
 	      counter += len3 + len2;
@@ -1118,10 +1131,10 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 			    }
 			}
 		      else
-		        {
+			{
 			  result = ASN1_DER_ERROR;
 			  goto cleanup;
-                        }
+			}
 		      counter += 2;
 		    }
 		  else
@@ -1142,7 +1155,7 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 		    {
 		      result = ASN1_DER_ERROR;
 		      goto cleanup;
-                    }
+		    }
 		  counter += len2;
 		  if (len3 > 0)
 		    {
@@ -1183,10 +1196,10 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 		  if (len2 == -1)
 		    {		/* indefinite length method */
 		      if ((counter + 2) > len)
-		        {
+			{
 			  result = ASN1_DER_ERROR;
 			  goto cleanup;
-                        }
+			}
 
 		      if ((der[counter]) || der[counter + 1])
 			{
@@ -1227,7 +1240,7 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 		    {
 		      result = ASN1_DER_ERROR;
 		      goto cleanup;
-                    }
+		    }
 		  counter += len2;
 		  if (len3)
 		    {
@@ -1258,24 +1271,24 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 	      if (asn1_get_tag_der
 		  (der + counter, len - counter, &class, &len2,
 		   &tag) != ASN1_SUCCESS)
-                {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      if (counter + len2 > len)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 	      len4 =
 		asn1_get_length_der (der + counter + len2,
 				     len - counter - len2, &len3);
 	      if (len4 < -1)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 	      if (len4 != -1)
 		{
 		  len2 += len4;
@@ -1311,7 +1324,7 @@ asn1_der_decoding (ASN1_TYPE * element, const void *ider, int len,
 			{
 			  result = ASN1_DER_ERROR;
 			  goto cleanup;
-                        }
+			}
 		    }
 		}
 	      move = RIGHT;
@@ -1657,10 +1670,10 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 	      len2 =
 		asn1_get_length_der (der + counter, len - counter, &len3);
 	      if (len2 < 0)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      if (state == FOUND)
 		{
@@ -1668,7 +1681,7 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 		    {
 		      result = ASN1_DER_ERROR;
 		      goto cleanup;
-                    }
+		    }
 		  _asn1_set_value (p, der + counter, len3 + len2);
 
 		  if (p == nodeFound)
@@ -1702,7 +1715,7 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 		    {
 		      result = ASN1_DER_ERROR;
 		      goto cleanup;
-                    }
+		    }
 		  len2 += len3;
 		}
 
@@ -1733,7 +1746,7 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 		    {
 		      result = ASN1_DER_ERROR;
 		      goto cleanup;
-                    }
+		    }
 		  len2 += len3;
 		}
 
@@ -1761,10 +1774,10 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 	      len2 =
 		asn1_get_length_der (der + counter, len - counter, &len3);
 	      if (len2 < 0)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      if (state == FOUND)
 		{
@@ -1772,7 +1785,7 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 		    {
 		      result = ASN1_DER_ERROR;
 		      goto cleanup;
-                    }
+		    }
 		  _asn1_set_value (p, der + counter, len3 + len2);
 
 		  if (p == nodeFound)
@@ -1785,17 +1798,17 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 	      len2 =
 		asn1_get_length_der (der + counter, len - counter, &len3);
 	      if (len2 < 0)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 	      if (state == FOUND)
 		{
 		  if (len3 + len2 > len - counter)
 		    {
 		      result = ASN1_DER_ERROR;
 		      goto cleanup;
-                    }
+		    }
 		  _asn1_set_value (p, der + counter, len3 + len2);
 
 		  if (p == nodeFound)
@@ -1839,10 +1852,10 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 			asn1_get_length_der (der + counter, len - counter,
 					     &len2);
 		      if (len3 < 0)
-		        {
+			{
 			  result = ASN1_DER_ERROR;
 			  goto cleanup;
-                        }
+			}
 		      counter += len2 + len3;
 		      move = RIGHT;
 		    }
@@ -1852,10 +1865,10 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 			asn1_get_length_der (der + counter, len - counter,
 					     &len2);
 		      if (len3 < 0)
-		        {
+			{
 			  result = ASN1_DER_ERROR;
 			  goto cleanup;
-                        }
+			}
 		      counter += len2;
 		      if (len3 > 0)
 			{
@@ -1922,10 +1935,10 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 			asn1_get_length_der (der + counter, len - counter,
 					     &len2);
 		      if (len3 < 0)
-		        {
+			{
 			  result = ASN1_DER_ERROR;
 			  goto cleanup;
-                        }
+			}
 		      counter += len2 + len3;
 		      move = RIGHT;
 		    }
@@ -1935,10 +1948,10 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 			asn1_get_length_der (der + counter, len - counter,
 					     &len2);
 		      if (len3 < 0)
-		        {
+			{
 			  result = ASN1_DER_ERROR;
 			  goto cleanup;
-                        }
+			}
 		      counter += len2;
 		      if (len3)
 			{
@@ -1964,25 +1977,25 @@ asn1_der_decoding_element (ASN1_TYPE * structure, const char *elementName,
 	      if (asn1_get_tag_der
 		  (der + counter, len - counter, &class, &len2,
 		   &tag) != ASN1_SUCCESS)
-                {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      if (counter + len2 > len)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      len4 =
 		asn1_get_length_der (der + counter + len2,
 				     len - counter - len2, &len3);
 	      if (len4 < -1)
-	        {
+		{
 		  result = ASN1_DER_ERROR;
 		  goto cleanup;
-                }
+		}
 
 	      if (len4 != -1)
 		{