diff options
| author | sam <sam@FreeBSD.org> | 2008-03-24 19:46:53 +0000 |
|---|---|---|
| committer | sam <sam@FreeBSD.org> | 2008-03-24 19:46:53 +0000 |
| commit | 153f9c1cd9a5b749f57e28682fadb39c781e1e5d (patch) | |
| tree | f77bae77287d18eaa89acc25e38b5acccca132fe /contrib/wpa_supplicant/asn1.c | |
| parent | 35aef052ff21baa52c4cec68b512986c21f70a48 (diff) | |
| download | FreeBSD-src-153f9c1cd9a5b749f57e28682fadb39c781e1e5d.zip FreeBSD-src-153f9c1cd9a5b749f57e28682fadb39c781e1e5d.tar.gz | |
Import of WPA supplicant 0.5.10
Diffstat (limited to 'contrib/wpa_supplicant/asn1.c')
| -rw-r--r-- | contrib/wpa_supplicant/asn1.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/contrib/wpa_supplicant/asn1.c b/contrib/wpa_supplicant/asn1.c index ff3db7d..96bc1ac 100644 --- a/contrib/wpa_supplicant/asn1.c +++ b/contrib/wpa_supplicant/asn1.c @@ -58,6 +58,10 @@ int asn1_get_next(const u8 *buf, size_t len, struct asn1_hdr *hdr) } tmp &= 0x7f; /* number of subsequent octets */ hdr->length = 0; + if (tmp > 4) { + wpa_printf(MSG_DEBUG, "ASN.1: Too long length field"); + return -1; + } while (tmp--) { if (pos >= end) { wpa_printf(MSG_DEBUG, "ASN.1: Length " @@ -71,7 +75,7 @@ int asn1_get_next(const u8 *buf, size_t len, struct asn1_hdr *hdr) hdr->length = tmp; } - if (pos + hdr->length > end) { + if (end < pos || hdr->length > (unsigned int) (end - pos)) { wpa_printf(MSG_DEBUG, "ASN.1: Contents underflow"); return -1; } |
