mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-04-06 16:10:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

x509asn1: Restore the parameter check in Curl_getASN1Element

Browse Source 
- Restore the removed parts of the parameter check.

Follow-up to 945f60e which altered the parameter check.
This commit is contained in:
Jay Satiro 2016-11-24 19:43:20 -05:00
parent 7d967c80bc
commit 2127457018
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/x509asn1.c
View File

@ -41,7 +41,7 @@
#include "memdebug.h"
/* For overflow checks. */
#define CURL_SIZE_T_MAX ((size_t) ~0)
#define CURL_SIZE_T_MAX ((size_t)-1)
/* ASN.1 OIDs. */
@ -119,8 +119,8 @@ const char *Curl_getASN1Element(curl_asn1Element *elem,
ending at `end'.
Returns a pointer in source string after the parsed element, or NULL
if an error occurs. */
if(!beg || !end || (size_t) (end - beg) > CURL_ASN1_MAX)
if(!beg || !end || beg >= end || !*beg ||
(size_t)(end - beg) > CURL_ASN1_MAX)
return (const char *) NULL;
/* Process header byte. */
@ -155,7 +155,7 @@ const char *Curl_getASN1Element(curl_asn1Element *elem,
elem->end = beg;
return beg + 1;
}
else if(beg + b > end)
else if((unsigned)b > (size_t)(end - beg))
return (const char *) NULL; /* Does not fit in source. */
else {
/* Get long length. */
@ -166,7 +166,7 @@ const char *Curl_getASN1Element(curl_asn1Element *elem,
len = (len << 8) | (unsigned char) *beg++;
} while(--b);
}
if((unsigned long) (end - beg) < len)
if(len > (size_t)(end - beg))
return (const char *) NULL; /* Element data does not fit in source. */
elem->beg = beg;
elem->end = beg + len;