Add length checks to avoid potential pointer wraparound.
@@ -742,7 +742,11 @@ asn1_get_integer(
if (length > sizeof(int))
{
+ if (length > (unsigned)(bufend - *buffer))
+ *buffer = bufend;
+ else
(*buffer) += length;
+
return (0);
}
@@ -776,7 +780,11 @@ asn1_get_length(unsigned char **buffer, // IO - Pointer in buffer
if ((count = length & 127) > sizeof(unsigned))
{
+ if (count > (bufend - *buffer))
+ *buffer = bufend;
+ else
(*buffer) += count;
+
return (0);
}
@@ -807,7 +815,14 @@ asn1_get_oid(
if (*buffer >= bufend)
+ {
return (0);
+ }
+ else if (length > (unsigned)(bufend - *buffer))
+ {
+ *buffer = bufend;
+ return (0);
+ }
valend = *buffer + length;
oidptr = oid;
