kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix encoding bug in i2c_ASN1_INTEGER

Browse Source 
(Imported from upstream's 3661bb4e7934668bd99ca777ea8b30eedfafa871.)

Fix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as
negative.

Thanks to Huzaifa Sidhpurwala <huzaifas@redhat.com> and Hanno Böck
<hanno@hboeck.de> for reporting this issue.

BUG=590615

Change-Id: I8959e8ae01510a5924862a3f353be23130eee554
Reviewed-on: https://boringssl-review.googlesource.com/7199
Reviewed-by: David Benjamin <davidben@google.com>
This commit is contained in:
Adam Langley 2016-02-29 08:01:05 -08:00 committed by David Benjamin
parent b944882f26
commit c4eec0c16b
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
crypto/asn1/a_int.c
View File

@ -124,6 +124,8 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
else { else {
ret = a->length; ret = a->length;
i = a->data[0]; i = a->data[0];
if (ret == 1 && i == 0)
neg = 0;
if (!neg && (i > 127)) { if (!neg && (i > 127)) {
pad = 1; pad = 1;
pb = 0; pb = 0;
@ -162,7 +164,7 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
p += a->length - 1; p += a->length - 1;
i = a->length; i = a->length;
/* Copy zeros to destination as long as source is zero */ /* Copy zeros to destination as long as source is zero */
while (!*n) { while (!*n && i > 1) {
*(p--) = 0; *(p--) = 0;
n--; n--;
i--; i--;