Return error when a bit string indicates an invalid amount of bits left

Reviewed-by: Matt Caswell <matt@openssl.org>

diff --git a/crypto/asn1/a_bitstr.c b/crypto/asn1/a_bitstr.c
index 34179960b87aed426902213ab2640ec6f4998d58..4117a67dc36fe7756787bbfa9bfffcf1c0d094a3 100644 (file)
--- a/crypto/asn1/a_bitstr.c
+++ b/crypto/asn1/a_bitstr.c
@@ -136,11 +136,16 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
 
        p= *pp;
        i= *(p++);
+       if (i > 7)
+               {
+               i=ASN1_R_INVALID_BIT_STRING_BITS_LEFT;
+               goto err;
+               }
        /* We do this to preserve the settings.  If we modify
         * the settings, via the _set_bit function, we will recalculate
         * on output */
        ret->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear */
-       ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|(i&0x07)); /* set */
+       ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|i); /* set */
 
        if (len-- > 1) /* using one because of the bits left byte */
                {

diff --git a/crypto/asn1/asn1.h b/crypto/asn1/asn1.h
index 59540e4e799e2c4de60430b261105adbfeb9f7ed..f6f491fda05deeb14a238eae2464dc55b68ed59e 100644 (file)
--- a/crypto/asn1/asn1.h
+++ b/crypto/asn1/asn1.h
@@ -1327,6 +1327,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_ILLEGAL_TIME_VALUE                       184
 #define ASN1_R_INTEGER_NOT_ASCII_FORMAT                         185
 #define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG               128
+#define ASN1_R_INVALID_BIT_STRING_BITS_LEFT             220
 #define ASN1_R_INVALID_BMPSTRING_LENGTH                         129
 #define ASN1_R_INVALID_DIGIT                            130
 #define ASN1_R_INVALID_MIME_TYPE                        205

diff --git a/crypto/asn1/asn1_err.c b/crypto/asn1/asn1_err.c
index 2975e0271e88f2e1eb32ab77c47f9f29e2102882..35293f288fbe14bb3cf99a9336987924e927c5bc 100644 (file)
--- a/crypto/asn1/asn1_err.c
+++ b/crypto/asn1/asn1_err.c
@@ -243,6 +243,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ERR_REASON(ASN1_R_ILLEGAL_TIME_VALUE)   ,"illegal time value"},
 {ERR_REASON(ASN1_R_INTEGER_NOT_ASCII_FORMAT),"integer not ascii format"},
 {ERR_REASON(ASN1_R_INTEGER_TOO_LARGE_FOR_LONG),"integer too large for long"},
+{ERR_REASON(ASN1_R_INVALID_BIT_STRING_BITS_LEFT),"invalid bit string bits left"},
 {ERR_REASON(ASN1_R_INVALID_BMPSTRING_LENGTH),"invalid bmpstring length"},
 {ERR_REASON(ASN1_R_INVALID_DIGIT)        ,"invalid digit"},
 {ERR_REASON(ASN1_R_INVALID_MIME_TYPE)    ,"invalid mime type"},