Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
A
asn1c
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Libraries
asn1c
Commits
97c5cfc8
Commit
97c5cfc8
authored
Jul 13, 2006
by
Lev Walkin
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
finally got it right
parent
1eded354
Changes
2
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
4 additions
and
1 deletion
+4
-1
skeletons/ber_tlv_length.c
skeletons/ber_tlv_length.c
+2
-1
skeletons/tests/check-length.c
skeletons/tests/check-length.c
+2
-0
No files found.
skeletons/ber_tlv_length.c
View file @
97c5cfc8
...
@@ -51,6 +51,7 @@ ber_fetch_length(int _is_constructed, const void *bufptr, size_t size,
...
@@ -51,6 +51,7 @@ ber_fetch_length(int _is_constructed, const void *bufptr, size_t size,
}
}
if
(
oct
==
0
)
{
if
(
oct
==
0
)
{
ber_tlv_len_t
lenplusepsilon
=
len
+
1024
;
/*
/*
* Here length may be very close or equal to 2G.
* Here length may be very close or equal to 2G.
* However, the arithmetics used in some decoders
* However, the arithmetics used in some decoders
...
@@ -58,7 +59,7 @@ ber_fetch_length(int _is_constructed, const void *bufptr, size_t size,
...
@@ -58,7 +59,7 @@ ber_fetch_length(int _is_constructed, const void *bufptr, size_t size,
* to check the resulting value against some limits.
* to check the resulting value against some limits.
* This may result in integer wrap-around.
* This may result in integer wrap-around.
*/
*/
if
(
(
len
+
1024
)
<
len
-
1024
)
{
if
(
lenplusepsilon
<
0
)
{
/* Too large length value */
/* Too large length value */
return
-
1
;
return
-
1
;
}
}
...
...
skeletons/tests/check-length.c
View file @
97c5cfc8
...
@@ -112,9 +112,11 @@ main() {
...
@@ -112,9 +112,11 @@ main() {
* Here although tlv_len is not greater than 2^31,
* Here although tlv_len is not greater than 2^31,
* we ought to hit an embedded length exploitation preventive check.
* we ought to hit an embedded length exploitation preventive check.
*/
*/
printf
(
"sizeof(tlv_len) = %d
\n
"
,
(
int
)
sizeof
(
tlv_len
));
if
(
sizeof
(
tlv_len
)
<=
4
)
{
if
(
sizeof
(
tlv_len
)
<=
4
)
{
ret
=
ber_fetch_length
(
0
,
buf3
,
sizeof
(
buf3
),
&
tlv_len
);
ret
=
ber_fetch_length
(
0
,
buf3
,
sizeof
(
buf3
),
&
tlv_len
);
printf
(
"ret=%ld
\n
"
,
(
long
)
ret
);
printf
(
"ret=%ld
\n
"
,
(
long
)
ret
);
printf
(
"len=0x%x
\n
"
,
(
long
)
tlv_len
);
assert
(
ret
==
-
1
);
assert
(
ret
==
-
1
);
}
}
if
(
sizeof
(
tlv_len
)
<=
8
)
{
if
(
sizeof
(
tlv_len
)
<=
8
)
{
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment