TLS: Fix ASN.1 parsing with no room for the header

Explicitly check the remaining buffer length before trying to read the
ASN.1 header values. Attempt to parse an ASN.1 header when there was not
enough buffer room for it would have started by reading one or two
octets beyond the end of the buffer before reporting invalid data at the
following explicit check for buffer room.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/tls/asn1.c b/src/tls/asn1.c
index cec109292d5ab37ef4452964e4e46070382f5c9e..822f87c182124ddcca13f4ef1c64eea0cdefaa9f 100644 (file)
--- a/src/tls/asn1.c
+++ b/src/tls/asn1.c
@@ -31,6 +31,10 @@ int asn1_get_next(const u8 *buf, size_t len, struct asn1_hdr *hdr)
        pos = buf;
        end = buf + len;
 
+       if (pos >= end) {
+               wpa_printf(MSG_DEBUG, "ASN.1: No room for Identifier");
+               return -1;
+       }
        hdr->identifier = *pos++;
        hdr->class = hdr->identifier >> 6;
        hdr->constructed = !!(hdr->identifier & (1 << 5));
@@ -51,6 +55,10 @@ int asn1_get_next(const u8 *buf, size_t len, struct asn1_hdr *hdr)
        } else
                hdr->tag = hdr->identifier & 0x1f;
 
+       if (pos >= end) {
+               wpa_printf(MSG_DEBUG, "ASN.1: No room for Length");
+               return -1;
+       }
        tmp = *pos++;
        if (tmp & 0x80) {
                if (tmp == 0xff) {