From: Andreas Schneider <asn@samba.org>
Date: Thu, 22 Nov 2018 13:45:20 +0000 (+0100)
Subject: lib:util: Fix undefined behavior in asn1 parser
X-Git-Tag: tdb-1.3.17~667
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=02913d088879500a149ef733eb618561434a9f3a;p=thirdparty%2Fsamba.git

lib:util: Fix undefined behavior in asn1 parser

lib/util/asn1.c:969 runtime error: left shift of negative value -1

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
---

diff --git a/lib/util/asn1.c b/lib/util/asn1.c
index d3b46aac857..60ddfa09bcf 100644
--- a/lib/util/asn1.c
+++ b/lib/util/asn1.c
@@ -953,21 +953,24 @@ bool asn1_read_ContextSimple(struct asn1_data *data, TALLOC_CTX *mem_ctx, uint8_
 bool asn1_read_implicit_Integer(struct asn1_data *data, int *i)
 {
 	uint8_t b;
+	uint32_t x = 0;
 	bool first_byte = true;
+
 	*i = 0;
 
 	while (!data->has_error && asn1_tag_remaining(data)>0) {
 		if (!asn1_read_uint8(data, &b)) return false;
 		if (first_byte) {
 			if (b & 0x80) {
-				/* Number is negative.
-				   Set i to -1 for sign extend. */
-				*i = -1;
+				/* Number is negative. */
+				x = (uint32_t)-1;
 			}
 			first_byte = false;
 		}
-		*i = (*i << 8) + b;
+		x = (x << 8) + b;
 	}
+	*i = (int)x;
+
 	return !data->has_error;
 }