Limit ASN.1 constructed types recursive definition depth
authorMatt Caswell <matt@openssl.org>
Thu, 22 Mar 2018 09:39:53 +0000 (09:39 +0000)
committerMatt Caswell <matt@openssl.org>
Tue, 27 Mar 2018 09:23:34 +0000 (10:23 +0100)
commit2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33
tree0e69c6d2738c34c03744560beddf5b15ec73585b
parentd8278dac47996a442a480958702d913f2eff7b93
Limit ASN.1 constructed types recursive definition depth

Constructed types with a recursive definition (such as can be found in
PKCS7) could eventually exceed the stack given malicious input with
excessive recursion. Therefore we limit the stack depth.

CVE-2018-0739

Credit to OSSFuzz for finding this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
crypto/asn1/asn1_err.c
crypto/asn1/tasn_dec.c
include/openssl/asn1.h