slacky.eu

asn1: additional sanity checking during BER decoding (CVE-2008-1673)

upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5

- Don't trust a length which is greater than the working buffer.
An invalid length could cause overflow when calculating buffer size
for decoding oid.

- An oid length of zero is invalid and allows for an off-by-one error when
decoding oid because the first subid actually encodes first 2 subids.

- A primitive encoding may not have an indefinite length.

conraid ha scritto:Che bug è quello che hanno corretto? Dove viene usata tale funzione?

asn1: additional sanity checking during BER decoding (CVE-2008-1673)

upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5

- Don't trust a length which is greater than the working buffer.
An invalid length could cause overflow when calculating buffer size
for decoding oid.

- An oid length of zero is invalid and allows for an off-by-one error when
decoding oid because the first subid actually encodes first 2 subids.

- A primitive encoding may not have an indefinite length.

Thanks to Wei Wang from McAfee for report.