asn1: Fix handling of invalid ASN.1 length in is_asn1()

Fixes CVE-2013-5018.

diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c
index 68f37f47116e832824cfea2c717632c44237de91..d860ad9a2a1a3af8fffc7a01d8e66a23812d3f38 100644 (file)
--- a/src/libstrongswan/asn1/asn1.c
+++ b/src/libstrongswan/asn1/asn1.c
@@ -642,6 +642,11 @@ bool is_asn1(chunk_t blob)
 
        len = asn1_length(&blob);
 
+       if (len == ASN1_INVALID_LENGTH)
+       {
+               return FALSE;
+       }
+
        /* exact match */
        if (len == blob.len)
        {