diff options
author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2018-01-04 10:52:05 +0100 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2018-01-04 10:56:53 +0100 |
commit | c593ae84cfcde8fea45787e53950e0ac71e9ca97 (patch) | |
tree | bbc8a9708b4ab3f97ff642dca059de69bad8a2f6 | |
parent | 0e74cc969d0d50ba8be6f11195f15923a9794b07 (diff) | |
download | libtasn1-c593ae84cfcde8fea45787e53950e0ac71e9ca97.tar.gz |
_asn1_decode_simple_ber: restrict the levels of recursion to 3
On indefinite string decoding, setting a maximum level of recursions
protects the BER decoder from a stack exhaustion due to large amounts
of recursion.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
-rw-r--r-- | lib/decoding.c | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/lib/decoding.c b/lib/decoding.c index 2240b09..0ee35d3 100644 --- a/lib/decoding.c +++ b/lib/decoding.c @@ -45,6 +45,13 @@ #define DECODE_FLAG_HAVE_TAG 1 #define DECODE_FLAG_INDEFINITE (1<<1) +/* On indefinite string decoding, allow this maximum levels + * of recursion. Allowing infinite recursion, makes the BER + * decoder susceptible to stack exhaustion due to that recursion. + */ +#define DECODE_FLAG_LEVEL1 (1<<2) +#define DECODE_FLAG_LEVEL2 (1<<3) +#define DECODE_FLAG_LEVEL3 (1<<4) #define DECR_LEN(l, s) do { \ l -= s; \ @@ -2216,7 +2223,8 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, } /* indefinite constructed */ - if (((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) + if ((((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) && + !(dflags & DECODE_FLAG_LEVEL3)) { len_len = 1; @@ -2236,8 +2244,17 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, do { unsigned tmp_len; + unsigned flags = DECODE_FLAG_HAVE_TAG; + + if (dflags & DECODE_FLAG_LEVEL1) + flags |= DECODE_FLAG_LEVEL2; + else if (dflags & DECODE_FLAG_LEVEL2) + flags |= DECODE_FLAG_LEVEL3; + else + flags |= DECODE_FLAG_LEVEL1; - result = asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len); + result = _asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len, + flags); if (result != ASN1_SUCCESS) { warn(); |