From d4b25980020821d4685752ecb9105c0902109ab5 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Fri, 15 Apr 2016 02:37:09 +0100 Subject: Fix ASN1_INTEGER handling. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only treat an ASN1_ANY type as an integer if it has the V_ASN1_INTEGER tag: V_ASN1_NEG_INTEGER is an internal only value which is never used for on the wire encoding. Thanks to David Benjamin for reporting this bug. This was found using libFuzzer. RT#4364 (part)CVE-2016-2108. Reviewed-by: Emilia Käsper --- crypto/asn1/tasn_dec.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'crypto/asn1/tasn_dec.c') diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c index 5a507967c8..6bdcd5c542 100644 --- a/crypto/asn1/tasn_dec.c +++ b/crypto/asn1/tasn_dec.c @@ -901,9 +901,7 @@ int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, break; case V_ASN1_INTEGER: - case V_ASN1_NEG_INTEGER: case V_ASN1_ENUMERATED: - case V_ASN1_NEG_ENUMERATED: tint = (ASN1_INTEGER **)pval; if (!c2i_ASN1_INTEGER(tint, &cont, len)) goto err; -- cgit v1.2.3