From 12cbb8e0497bc4990cfb02f1b9ebe23df9b53a2c Mon Sep 17 00:00:00 2001 From: Richard Levitte Date: Fri, 1 May 2020 18:06:18 +0200 Subject: WPACKET: don't write DER length when we don't want to With endfirst writing, it could be that we want to abandon any zero length sub-packet. That's what WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH was supposed to make happen, but the DER length writing code didn't look at that flag. Now it does. Reviewed-by: Matt Caswell Reviewed-by: Ben Kaduk (Merged from https://github.com/openssl/openssl/pull/11703) --- crypto/packet.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'crypto/packet.c') diff --git a/crypto/packet.c b/crypto/packet.c index 661b59e842..6db97a5434 100644 --- a/crypto/packet.c +++ b/crypto/packet.c @@ -265,7 +265,10 @@ static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose) && !put_value(&buf[sub->packet_len], packlen, sub->lenbytes)) return 0; - } else if (pkt->endfirst && sub->parent != NULL) { + } else if (pkt->endfirst && sub->parent != NULL + && (packlen != 0 + || (sub->flags + & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) == 0)) { size_t tmplen = packlen; size_t numlenbytes = 1; -- cgit v1.2.1