Fix for cert selftest.

diff --git a/lib/minitasn1/decoding.c b/lib/minitasn1/decoding.c
index 9fe36ea5197e938b8fe740bcc68ed43aef000ee3..2310d189893c400b473692c64380b2e2683dd5d5 100644 (file)
--- a/lib/minitasn1/decoding.c
+++ b/lib/minitasn1/decoding.c
@@ -1,6 +1,6 @@
 /*
+ *      Copyright (C) 2004, 2006 Free Software Foundation
  *      Copyright (C) 2002 Fabio Fiorina
- *      Copyright (C) 2004 Simon Josefsson
  *
  * This file is part of LIBASN1.
  *
@@ -720,7 +720,7 @@ asn1_der_decoding(ASN1_TYPE *element,const void *ider,int len,
        break;
       case TYPE_INTEGER: case TYPE_ENUMERATED:
        len2=_asn1_get_length_der(der+counter,len-counter, &len3);
-
+       if (len2 <= 0) return ASN1_DER_ERROR;
        if (len2+len3 > len-counter) return ASN1_DER_ERROR;
        _asn1_set_value(p,der+counter,len3+len2);
        counter+=len3+len2;
@@ -755,6 +755,7 @@ asn1_der_decoding(ASN1_TYPE *element,const void *ider,int len,
        break;
       case TYPE_GENERALSTRING:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 <= 0) return ASN1_DER_ERROR;
        if (len3+len2 > len-counter) return ASN1_DER_ERROR;
           _asn1_set_value(p,der+counter,len3+len2);
        counter+=len3+len2;
@@ -762,6 +763,7 @@ asn1_der_decoding(ASN1_TYPE *element,const void *ider,int len,
        break;
       case TYPE_BIT_STRING:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 <= 0) return ASN1_DER_ERROR;
        if (len3+len2 > len-counter) return ASN1_DER_ERROR;
           _asn1_set_value(p,der+counter,len3+len2);
        counter+=len3+len2;
@@ -1201,6 +1203,7 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
        break;
       case TYPE_INTEGER: case TYPE_ENUMERATED:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 <= 0) return ASN1_DER_ERROR;
        if(state==FOUND){
          if (len3+len2 > len-counter) return ASN1_DER_ERROR;
          _asn1_set_value(p,der+counter,len3+len2);
@@ -1222,6 +1225,7 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
        }
        else{
          len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+         if (len2 <= 0) return ASN1_DER_ERROR;
          len2+=len3;
        }
 
@@ -1244,6 +1248,7 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
        }
        else{
          len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+         if (len2 <= 0) return ASN1_DER_ERROR;
          len2+=len3;
        }
 
@@ -1265,6 +1270,7 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
        break;
       case TYPE_GENERALSTRING:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 < 0) return ASN1_DER_ERROR;
        if(state==FOUND){
          if (len3+len2 > len-counter) return ASN1_DER_ERROR;
          _asn1_set_value(p,der+counter,len3+len2);
@@ -1276,6 +1282,7 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
        break;
       case TYPE_BIT_STRING:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 < 0) return ASN1_DER_ERROR;
        if(state==FOUND){
          if (len3+len2 > len-counter) return ASN1_DER_ERROR;
          _asn1_set_value(p,der+counter,len3+len2);
@@ -1308,11 +1315,13 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
        else{   /* move==DOWN || move==RIGHT */
          if(state==OTHER_BRANCH){
            len3=_asn1_get_length_der(der+counter,len-counter,&len2);
+           if (len3 < 0) return ASN1_DER_ERROR;
            counter+=len2+len3;
            move=RIGHT;
          }
          else { /*  state==SAME_BRANCH or state==FOUND */
            len3=_asn1_get_length_der(der+counter,len-counter,&len2);
+           if (len3 < -1) return ASN1_DER_ERROR;
            counter+=len2;
            if(len3>0){
              _asn1_ltostr(counter+len3,temp);
@@ -1363,11 +1372,13 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
        else{   /* move==DOWN || move==RIGHT */
          if(state==OTHER_BRANCH){
            len3=_asn1_get_length_der(der+counter,len-counter,&len2);
+           if (len3 < 0) return ASN1_DER_ERROR;
            counter+=len2+len3;
            move=RIGHT;
          }
          else{ /* state==FOUND or state==SAME_BRANCH */
            len3=_asn1_get_length_der(der+counter,len-counter,&len2);
+           if (len3 < 0) return ASN1_DER_ERROR;
            counter+=len2;
            if(len3){
              _asn1_ltostr(counter+len3,temp);
@@ -1390,7 +1401,8 @@ asn1_der_decoding_element(ASN1_TYPE *structure,const char *elementName,
           return ASN1_DER_ERROR;
 
        len4=_asn1_get_length_der(der+counter+len2,len-counter-len2,&len3);
-       
+       if (len4 < -1) return ASN1_DER_ERROR;
+
        if(len4 != -1){
          len2+=len4;
          if(state==FOUND){
@@ -1700,16 +1712,19 @@ asn1_der_decoding_startEnd(ASN1_TYPE element,const void *ider,int len,
        break;
       case TYPE_INTEGER: case TYPE_ENUMERATED:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 <= 0) return ASN1_DER_ERROR;
        counter+=len3+len2;
        move=RIGHT;
        break;
       case TYPE_OBJECT_ID:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 <= 0) return ASN1_DER_ERROR;
        counter+=len2+len3;
        move=RIGHT;
       break;
       case TYPE_TIME:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 <= 0) return ASN1_DER_ERROR;
        counter+=len2+len3;
        move=RIGHT;
        break;
@@ -1722,17 +1737,20 @@ asn1_der_decoding_startEnd(ASN1_TYPE element,const void *ider,int len,
        break;
       case TYPE_GENERALSTRING:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 < 0) return ASN1_DER_ERROR;
        counter+=len3+len2;
        move=RIGHT;
        break;
       case TYPE_BIT_STRING:
        len2=_asn1_get_length_der(der+counter,len-counter,&len3);
+       if (len2 < 0) return ASN1_DER_ERROR;
        counter+=len3+len2;
        move=RIGHT;
        break;
       case TYPE_SEQUENCE:  case TYPE_SET:
        if(move!=UP){
          len3=_asn1_get_length_der(der+counter,len-counter,&len2);
+         if (len3 < 0) return ASN1_DER_ERROR;
          counter+=len2;
          if(len3==0) move=RIGHT;
          else move=DOWN; 
@@ -1746,6 +1764,7 @@ asn1_der_decoding_startEnd(ASN1_TYPE element,const void *ider,int len,
       case TYPE_SEQUENCE_OF: case TYPE_SET_OF:
        if(move!=UP){
          len3=_asn1_get_length_der(der+counter,len-counter,&len2);
+         if (len3 < -1) return ASN1_DER_ERROR;
          counter+=len2;
          if((len3==-1) && !der[counter] && !der[counter+1])
            counter+=2;
@@ -1767,7 +1786,8 @@ asn1_der_decoding_startEnd(ASN1_TYPE element,const void *ider,int len,
         return ASN1_DER_ERROR;
 
        len4=_asn1_get_length_der(der+counter+len2,len-counter-len2,&len3);
-       
+       if (len4 < -1) return ASN1_DER_ERROR;
+
        if(len4 != -1){
          counter+=len2+len4+len3;
        }
@@ -1939,7 +1959,8 @@ asn1_expand_any_defined_by(ASN1_TYPE definitions,ASN1_TYPE *element)
                if(result == ASN1_SUCCESS){
                  _asn1_set_name(aux,p->name);
                  len2=_asn1_get_length_der(p->value,p->value_len,&len3);
-                 
+                 if (len2 <= 0) return ASN1_DER_ERROR;
+
                  result=asn1_der_decoding(&aux,p->value+len3,len2,
                                           errorDescription);
                  if(result == ASN1_SUCCESS){
@@ -2103,7 +2124,8 @@ asn1_expand_octet_string(ASN1_TYPE definitions,ASN1_TYPE *element,
          if(result == ASN1_SUCCESS){
            _asn1_set_name(aux,octetNode->name);          
            len2=_asn1_get_length_der(octetNode->value,octetNode->value_len,&len3);
-           
+           if (len2 <= 0) return ASN1_DER_ERROR;
+
            result=asn1_der_decoding(&aux,octetNode->value+len3,len2,
                                     errorDescription);
            if(result == ASN1_SUCCESS){