KEYS: Fix ASN.1 indefinite length object parsing
authorDavid Howells <dhowells@redhat.com>
Tue, 23 Feb 2016 11:03:12 +0000 (11:03 +0000)
committerDavid Howells <dhowells@redhat.com>
Thu, 12 May 2016 11:01:49 +0000 (12:01 +0100)
commit23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa
tree1dcc45a724c37da55f4497d7ec7ccdc595bf6878
parent685764b108a7e5fe9f5ee213d6a627c1166d7c88
KEYS: Fix ASN.1 indefinite length object parsing

This fixes CVE-2016-0758.

In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
it isn't validated against the remaining amount of data before being added
to the cursor.  With a sufficiently large size indicated, the check:

datalen - dp < 2

may then fail due to integer overflow.

Fix this by checking the length indicated against the amount of remaining
data in both places a definite length is determined.

Whilst we're at it, make the following changes:

 (1) Check the maximum size of extended length does not exceed the capacity
     of the variable it's being stored in (len) rather than the type that
     variable is assumed to be (size_t).

 (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
     integer 0.

 (3) To reduce confusion, move the initialisation of len outside of:

for (len = 0; n > 0; n--) {

     since it doesn't have anything to do with the loop counter n.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: David Woodhouse <David.Woodhouse@intel.com>
Acked-by: Peter Jones <pjones@redhat.com>
lib/asn1_decoder.c