From 9d2457898b0b69de1602e5f4bdb8026c308e8b61 Mon Sep 17 00:00:00 2001 From: Assar Westerlund Date: Fri, 29 Dec 2000 03:34:16 +0000 Subject: [PATCH] (loop): check for length longer than data. inspired by lha@stacken.kth.se git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@9424 ec53bebd-3082-4978-b11e-865c3cabbd6b --- lib/asn1/asn1_print.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/asn1/asn1_print.c b/lib/asn1/asn1_print.c index 59e5ed6d8..2a32ea57d 100644 --- a/lib/asn1/asn1_print.c +++ b/lib/asn1/asn1_print.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -99,6 +99,9 @@ loop (unsigned char *buf, size_t len, int indent) ret = der_get_tag (buf, len, &class, &type, &tag, &sz); if (ret) errx (1, "der_get_tag: %s", com_right (et_list, ret)); + if (sz > len) + errx (1, "unreasonable length (%u) > %u", + (unsigned)sz, (unsigned)len); buf += sz; len -= sz; for (i = 0; i < indent; ++i)