diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-05-18 18:03:34 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-05-18 18:14:17 +0200 |
| commit | 5520704d075802df25ce4ffccc010ba1641bd484 (patch) | |
| tree | 9cfe6966bfd2ae6cfcfe69a7bc9947c9d854f98c | |
| parent | 8f4b3ef8df0e337b4d1430cf50e4f3c3ef577353 (diff) | |
| download | libtasn1-5520704d075802df25ce4ffccc010ba1641bd484.tar.gz | |
asn1_find_node: added safety check on asn1_find_node()
This prevents a stack overflow in asn1_find_node() which
is triggered by too long variable names in the definitions
files. That means that applications have to deliberately
pass a too long 'name' constant to asn1_write_value()
and friends. Reported by Jakub Jirasek.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| -rw-r--r-- | lib/parser_aux.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/parser_aux.c b/lib/parser_aux.c index b4a7370..976ab38 100644 --- a/lib/parser_aux.c +++ b/lib/parser_aux.c @@ -120,6 +120,9 @@ asn1_find_node (asn1_node pointer, const char *name) if (n_end) { nsize = n_end - n_start; + if (nsize >= sizeof(n)) + return NULL; + memcpy (n, n_start, nsize); n[nsize] = 0; n_start = n_end; @@ -158,6 +161,9 @@ asn1_find_node (asn1_node pointer, const char *name) if (n_end) { nsize = n_end - n_start; + if (nsize >= sizeof(n)) + return NULL; + memcpy (n, n_start, nsize); n[nsize] = 0; n_start = n_end; |