Update from HEAD.

diff --git a/crypto/asn1/asn1.h b/crypto/asn1/asn1.h
index d75aa0dc03a7b0583186155a267ab1aa70798949..0184b475a7238d8ef6f3eba1d3799e4ad8d69d1d 100644 (file)
--- a/crypto/asn1/asn1.h
+++ b/crypto/asn1/asn1.h
@@ -1076,6 +1076,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_MISSING_SECOND_NUMBER                    138
 #define ASN1_R_MSTRING_NOT_UNIVERSAL                    139
 #define ASN1_R_MSTRING_WRONG_TAG                        140
+#define ASN1_R_NESTED_ASN1_STRING                       174
 #define ASN1_R_NON_HEX_CHARACTERS                       141
 #define ASN1_R_NOT_ENOUGH_DATA                          142
 #define ASN1_R_NO_MATCHING_CHOICE_TYPE                  143

diff --git a/crypto/asn1/asn1_err.c b/crypto/asn1/asn1_err.c
index cb39d35a9a880bcb300b1dfd98ffb8ca4d0ba6fd..315d0a0807978cc967db30b1a162977998c5df37 100644 (file)
--- a/crypto/asn1/asn1_err.c
+++ b/crypto/asn1/asn1_err.c
@@ -203,6 +203,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ERR_REASON(ASN1_R_MISSING_SECOND_NUMBER),"missing second number"},
 {ERR_REASON(ASN1_R_MSTRING_NOT_UNIVERSAL),"mstring not universal"},
 {ERR_REASON(ASN1_R_MSTRING_WRONG_TAG)    ,"mstring wrong tag"},
+{ERR_REASON(ASN1_R_NESTED_ASN1_STRING)   ,"nested asn1 string"},
 {ERR_REASON(ASN1_R_NON_HEX_CHARACTERS)   ,"non hex characters"},
 {ERR_REASON(ASN1_R_NOT_ENOUGH_DATA)      ,"not enough data"},
 {ERR_REASON(ASN1_R_NO_MATCHING_CHOICE_TYPE),"no matching choice type"},

diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c
index 86c901199b6a67a095ea3ef67a99e55de7baf8b9..d9aafacbdfc46f0e8342cd78363eca08b3605050 100644 (file)
--- a/crypto/asn1/tasn_dec.c
+++ b/crypto/asn1/tasn_dec.c
@@ -895,7 +895,13 @@ static int asn1_collect(BUF_MEM *buf, unsigned char **in, long len, char inf, in
                }
                /* If indefinite length constructed update max length */
                if(cst) {
-                       if(!asn1_collect(buf, &p, plen, ininf, tag, aclass)) return 0;
+#ifdef OPENSSL_ALLOW_NESTED_ASN1_STRINGS
+                       if (!asn1_collect(buf, &p, plen, ininf, tag, aclass))
+                               return 0;
+#else
+                       ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_NESTED_ASN1_STRING);
+                       return 0;
+#endif
                } else {
                        if(!collect_data(buf, &p, plen)) return 0;
                }