Don't use chunk_skip() in asn1_length().

chunk_skip() returns chunk_empty if the length of the chunk is equal to
the number of bytes to skip, this is problematic as asn1_length() modifies
the original chunk.  asn1_parser_t for instance uses the modified chunk to
later calculate the length of the resulting ASN.1 object which produces
incorrect results if it is based on chunk_empty.

diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c
index 4cb38d1266cf9057e03b157da1ecaee9741ca387..8adab858058ad6318eba390a0cc22d06c57d28f5 100644 (file)
--- a/src/libstrongswan/asn1/asn1.c
+++ b/src/libstrongswan/asn1/asn1.c
@@ -228,7 +228,8 @@ size_t asn1_length(chunk_t *blob)
 
        /* read length field, skip tag and length */
        n = blob->ptr[1];
-       *blob = chunk_skip(*blob, 2);
+       blob->ptr += 2;
+       blob->len -= 2;
 
        if ((n & 0x80) == 0)
        {       /* single length octet */