ITS#10533 liblber: more for ITS#10489

Another potential 1-byte overread

diff --git a/libraries/liblber/decode.c b/libraries/liblber/decode.c
index d8fca339fd033cf40835ad1068de3b69f949e8e6..9682c1e298e8c3d14603df4f73de7b0dabf37a61 100644 (file)
--- a/libraries/liblber/decode.c
+++ b/libraries/liblber/decode.c
@@ -415,7 +415,9 @@ ber_get_stringbvl( BerElement *ber, bgbvr *b )
                }
 
                ber->ber_ptr = orig;
-               ber->ber_tag = *(unsigned char *) orig;
+               ber->ber_tag = ( orig < ber->ber_end ) ?
+                       *(unsigned char *)orig :
+                       LBER_DEFAULT;
        }
 
        b->siz = i;