From: jsing <jsing@openbsd.org>
Date: Sat, 12 Feb 2022 03:07:24 +0000 (+0000)
Subject: Avoid potential single byte overread in asn1_parse2().
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=5404b1211a613d4f12762b93d5f0c447b92ffed6;p=openbsd

Avoid potential single byte overread in asn1_parse2().

A fix for this was previously commited in r1.32, however while this added
a bounds check the logic means we still fall through and perform the
overread. Fix the logic such that we only log the error if the bounds check
fails. While here, flip the test around such that we check for validity then
print (which is more readable and matches earlier code).

ok inoguchi@ tb@
---

diff --git a/lib/libcrypto/asn1/asn1_par.c b/lib/libcrypto/asn1/asn1_par.c
index 2d1c7b2b487..6c14f271b68 100644
--- a/lib/libcrypto/asn1/asn1_par.c
+++ b/lib/libcrypto/asn1/asn1_par.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_par.c,v 1.33 2022/01/20 10:49:56 inoguchi Exp $ */
+/* $OpenBSD: asn1_par.c,v 1.34 2022/02/12 03:07:24 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -233,12 +233,13 @@ asn1_parse2(BIO *bp, const unsigned char **pp, long length, int offset,
 						goto end;
 				}
 			} else if (tag == V_ASN1_BOOLEAN) {
-				if (len != 1 || p >= tot) {
+				if (len == 1 && p < tot) {
+					BIO_printf(bp, ":%u", p[0]);
+				} else {
 					if (BIO_write(bp, "Bad boolean\n",
 					    12) <= 0)
 						goto end;
 				}
-				BIO_printf(bp, ":%u", p[0]);
 			} else if (tag == V_ASN1_BMPSTRING) {
 				/* do the BMP thang */
 			} else if (tag == V_ASN1_OCTET_STRING) {