* asn1_decode.c (asn1_decode_integer): Fix to deal with overflows

 	and negative integers.
	(asn1_decode_unsigned_integer): Fix to deal with overflows and to
 	return errors on encountering negative integers.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@11558 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/asn.1/ChangeLog b/src/lib/krb5/asn.1/ChangeLog
index cc9f48985f245ef4eb620c7d230b4e7f0c57dd9f..50c7808aaedbf8aa1cb7a7962e879025abce5bb1 100644 (file)
--- a/src/lib/krb5/asn.1/ChangeLog
+++ b/src/lib/krb5/asn.1/ChangeLog
@@ -1,3 +1,10 @@
+Sat Jul 10 10:21:40 1999  Tom Yu  <chaoself@mit.edu>
+
+       * asn1_decode.c (asn1_decode_integer): Fix to deal with overflows
+       and negative integers.
+       (asn1_decode_unsigned_integer): Fix to deal with overflows and to
+       return errors on encountering negative integers.
+
 1999-07-06  Ken Raeburn  <raeburn@mit.edu>
 
        * KRB5-asn.py (PA-SAM-RESPONSE): Fix syntax error -- comma

diff --git a/src/lib/krb5/asn.1/asn1_decode.c b/src/lib/krb5/asn.1/asn1_decode.c
index cb48c2e5b729f2b5906c97a240f00f7552a485b7..189f7c082a1d8afa20a5a9f50a2530d0a2b972c6 100644 (file)
--- a/src/lib/krb5/asn.1/asn1_decode.c
+++ b/src/lib/krb5/asn.1/asn1_decode.c
@@ -58,14 +58,22 @@ asn1_error_code asn1_decode_integer(buf, val)
 {
   setup();
   asn1_octet o;
-  unsigned long n;
+  long n;
+  int i;
 
   tag(ASN1_INTEGER);
 
-  for(n=0; length > 0; length--){
-    retval = asn1buf_remove_octet(buf,&o);
-    if(retval) return retval;
-    n = (n<<8) + (unsigned int)o;
+  for (i = 0; i < length; i++) {
+    retval = asn1buf_remove_octet(buf, &o);
+    if (retval) return retval;
+    if (!i) {
+      n = (0x80 & o) ? -1 : 0; /* grab sign bit */
+      if (n < 0 && length > sizeof (long))
+       return ASN1_OVERFLOW;
+      else if (length > sizeof (long) + 1) /* allow extra octet for positive */
+       return ASN1_OVERFLOW;
+    }
+    n = (n << 8) | o;
   }
   *val = n;
   cleanup();
@@ -78,13 +86,20 @@ asn1_error_code asn1_decode_unsigned_integer(buf, val)
   setup();
   asn1_octet o;
   unsigned long n;
+  int i;
 
   tag(ASN1_INTEGER);
 
-  for(n=0; length > 0; length--){
-    retval = asn1buf_remove_octet(buf,&o);
+  for (i = 0, n = 0; i < length; i++) {
+    retval = asn1buf_remove_octet(buf, &o);
     if(retval) return retval;
-    n = (n<<8) + (unsigned int)o;
+    if (!i) {
+      if (0x80 & o)
+       return ASN1_OVERFLOW;
+      else if (length > sizeof (long) + 1)
+       return ASN1_OVERFLOW;
+    }
+    n = (n << 8) | o;
   }
   *val = n;
   cleanup();