oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

asn1: Fix open decode bug found by AFL

Browse Source 
Should always run AFL before pushing changes to the ASN.1 compiler or
template interpreter!

Still fuzzing.  There are crashers in the _asn1_print() path, though
right now they cannot affect anything else in Heimdal other than
asn1_print, since that's the only thing calling it yet.
This commit is contained in:
Nicolas Williams
2021-03-03 23:29:25 -06:00
parent 1d2bfd6179
commit c6fab6c871
1 changed files with 5 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/asn1/template.c
View File

@@ -645,6 +645,7 @@ _asn1_decode_open_type(const struct asn1_template *t,
* All the union arms are pointers. * All the union arms are pointers.
*/ */
if (ret) { if (ret) {
_asn1_free(tactual_type->ptr, o);
free(o); free(o);
/* /*
* So we failed to decode the open type -- that should not be fatal * So we failed to decode the open type -- that should not be fatal
@@ -688,26 +689,18 @@ _asn1_decode_open_type(const struct asn1_template *t,
/* Increment the count of decoded values as we decode */ /* Increment the count of decoded values as we decode */
*lenp = len; *lenp = len;
for (i = 0; ret != ENOMEM && i < len; i++) { for (i = 0; ret != ENOMEM && i < len; i++) {
if ((val[i] = calloc(len, tactual_type->offset)) == NULL) if ((val[i] = calloc(1, tactual_type->offset)) == NULL)
ret = ENOMEM; ret = ENOMEM;
if (ret == 0 && d[i]) if (ret == 0 && d[i])
/* Re-enter to decode the encoded open type value */ /* Re-enter to decode the encoded open type value */
ret = _asn1_decode(tactual_type->ptr, flags, d[i]->data, ret = _asn1_decode(tactual_type->ptr, flags, d[0][i].data,
d[i]->length, val[i], &sz); d[0][i].length, val[i], &sz);
if (ret) { if (ret) {
_asn1_free(tactual_type->ptr, val[i]);
free(val[i]); free(val[i]);
val[i] = NULL; val[i] = NULL;
} }
} }
if (ret == ENOMEM) {
for (i = 0; i < len; i++) {
_asn1_free(tactual_type->ptr, val[i]);
free(val[i]);
}
free(val);
val = 0;
*lenp = 0;
}
if (ret != ENOMEM) if (ret != ENOMEM)
ret = 0; /* See above */ ret = 0; /* See above */
*dp = val; *dp = val;