[Midnightbsd-cvs] src [12240] trunk/contrib/bsnmp/lib/asn1.c: A function extracting the length from type-length-value encoding is not

[laffer1 at midnightbsd.org]

Revision: 12240
          http://svnweb.midnightbsd.org/src/?rev=12240
Author:   laffer1
Date:     2019-08-08 21:29:55 -0400 (Thu, 08 Aug 2019)
Log Message:
-----------
A function extracting the length from type-length-value encoding is not
properly validating the submitted length.

Modified Paths:
--------------
    trunk/contrib/bsnmp/lib/asn1.c

Modified: trunk/contrib/bsnmp/lib/asn1.c
===================================================================
--- trunk/contrib/bsnmp/lib/asn1.c	2019-08-09 01:29:32 UTC (rev 12239)
+++ trunk/contrib/bsnmp/lib/asn1.c	2019-08-09 01:29:55 UTC (rev 12240)
@@ -100,6 +100,11 @@
 		*len = *b->asn_cptr++;
 		b->asn_len--;
 	}
+	if (*len > b->asn_len) {
+		asn_error(b, "len %u exceeding asn_len %u", *len, b->asn_len);
+		return (ASN_ERR_EOBUF);
+	}
+	
 	return (ASN_ERR_OK);
 }