From c6c2749fb4305c3a8c97594691fff906dfb4390a Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 23 Jan 2020 13:59:18 -0800 Subject: [PATCH] lib: asn1.c: Prevent ASN1_ENUMERATED from wrapping. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14238 Signed-off-by: Jeremy Allison --- lib/util/asn1.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/lib/util/asn1.c b/lib/util/asn1.c index 51da5424956..6ae54d4cf20 100644 --- a/lib/util/asn1.c +++ b/lib/util/asn1.c @@ -1024,9 +1024,10 @@ bool asn1_read_BitString(struct asn1_data *data, TALLOC_CTX *mem_ctx, DATA_BLOB return true; } -/* read an integer */ +/* read a non-negative enumerated value */ bool asn1_read_enumerated(struct asn1_data *data, int *v) { + unsigned int val_will_wrap = (0xFF << ((sizeof(int)*8)-8)); *v = 0; if (!asn1_start_tag(data, ASN1_ENUMERATED)) return false; @@ -1035,7 +1036,22 @@ bool asn1_read_enumerated(struct asn1_data *data, int *v) if (!asn1_read_uint8(data, &b)) { return false; } + if (*v & val_will_wrap) { + /* + * There is something already in + * the top byte of the int. If we + * shift left by 8 it's going to + * wrap. Prevent this. + */ + data->has_error = true; + return false; + } *v = (*v << 8) + b; + if (*v < 0) { + /* ASN1_ENUMERATED can't be -ve. */ + data->has_error = true; + return false; + } } return asn1_end_tag(data); } -- 2.25.0.341.g760bfbb309-goog