Avoid buffer overflow in asn1_parse2
authorinoguchi <inoguchi@openbsd.org>
Fri, 14 Jan 2022 23:55:46 +0000 (23:55 +0000)
committerinoguchi <inoguchi@openbsd.org>
Fri, 14 Jan 2022 23:55:46 +0000 (23:55 +0000)
commite457bdd15fcf75f91b9a412147cc1dfbe46f436c
treea5e2882de300aacd3c7779543c69404775e439fe
parent9176875972eab762ad74f74e5b3ba0d4cec78272
Avoid buffer overflow in asn1_parse2

asn1_par.c r1.29 changed to access p[0] directly, and this pointer could be
overrun since ASN1_get_object advances pointer to the first content octet.
In case invalid ASN1 Boolean data, it has length but no content, I thought
this could be happen.
Adding check p with tot (diff below) will avoid this failure.

Reported by oss-fuzz 43633 and 43648(later)

ok tb@
lib/libcrypto/asn1/asn1_par.c