From eebfd896fe178b4ca78bbd8064944a5b31a27667 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Mon, 14 Mar 2016 19:23:58 -0400 Subject: [PATCH] Don't shift serial number into sign bit (Imported from upstream's 01c32b5e448f6d42a23ff16bdc6bb0605287fa6f.) Change-Id: Ib52278dbbac1ed1ad5c80f0ad69e34584d411cec Reviewed-on: https://boringssl-review.googlesource.com/7461 Reviewed-by: Steven Valdez Reviewed-by: David Benjamin --- crypto/x509/t_x509.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/x509/t_x509.c b/crypto/x509/t_x509.c index b2623610..1fba9b43 100644 --- a/crypto/x509/t_x509.c +++ b/crypto/x509/t_x509.c @@ -133,7 +133,8 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, goto err; bs = X509_get_serialNumber(x); - if (bs->length <= (int)sizeof(long)) { + if (bs->length < (int)sizeof(long) + || (bs->length == sizeof(long) && (bs->data[0] & 0x80) == 0)) { l = ASN1_INTEGER_get(bs); if (bs->type == V_ASN1_NEG_INTEGER) { l = -l;