From: Dr. Stephen Henson <steve@openssl.org>
Date: Fri, 23 Aug 2002 00:00:54 +0000 (+0000)
Subject: Reinstate the check for invalid length BIT STRINGS,
X-Git-Tag: OpenSSL_0_9_7-beta4~178
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=a69d50b02dcb617c9e82c7e80dfa147ed304ce69;p=oweals%2Fopenssl.git

Reinstate the check for invalid length BIT STRINGS,
which was effectively bypassed in the ASN1 changed.
---

diff --git a/crypto/asn1/a_bitstr.c b/crypto/asn1/a_bitstr.c
index ed0bdfbde1..e0265f69d2 100644
--- a/crypto/asn1/a_bitstr.c
+++ b/crypto/asn1/a_bitstr.c
@@ -120,6 +120,12 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
 	unsigned char *p,*s;
 	int i;
 
+	if (len < 1)
+		{
+		i=ASN1_R_STRING_TOO_SHORT;
+		goto err;
+		}
+
 	if ((a == NULL) || ((*a) == NULL))
 		{
 		if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL);
diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c
index 0fc1f421e2..f87c08793a 100644
--- a/crypto/asn1/tasn_dec.c
+++ b/crypto/asn1/tasn_dec.c
@@ -913,10 +913,10 @@ static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *i
 			ctx->ptag = ptag;
 			ctx->hdrlen = p - q;
 			ctx->valid = 1;
-			/* If definite length, length + header can't exceed total
-			 * amount of data available.
+			/* If definite length, and no error, length +
+			 * header can't exceed total amount of data available. 
 			 */
-			if(!(i & 1) && ((plen + ctx->hdrlen) > len)) {
+			if(!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {
 				ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG);
 				asn1_tlc_clear(ctx);
 				return 0;