Commit baaa24fa authored by Lev Walkin's avatar Lev Walkin

added stack checking into ber_skip_length also

parent c500b3e1
...@@ -71,10 +71,12 @@ ber_check_tags(asn_codec_ctx_t *opt_codec_ctx, ...@@ -71,10 +71,12 @@ ber_check_tags(asn_codec_ctx_t *opt_codec_ctx,
int step = opt_ctx ? opt_ctx->step : 0; /* Where we left previously */ int step = opt_ctx ? opt_ctx->step : 0; /* Where we left previously */
int tagno; int tagno;
/*
* Make sure we didn't exceed the maximum stack size.
*/
if(opt_codec_ctx && opt_codec_ctx->max_stack_size) { if(opt_codec_ctx && opt_codec_ctx->max_stack_size) {
ptrdiff_t usedstack = ((char *)opt_codec_ctx - (char *)&size); ptrdiff_t usedstack = ((char *)opt_codec_ctx - (char *)&size);
/* do not change the semantics: /* double negative is required to avoid int wrap-around */
* double negative is required to avoid int wrap-around */
if(usedstack > 0) usedstack = -usedstack; if(usedstack > 0) usedstack = -usedstack;
ASN_DEBUG("Current stack size %ld", -(long)usedstack); ASN_DEBUG("Current stack size %ld", -(long)usedstack);
if(usedstack < -(ptrdiff_t)opt_codec_ctx->max_stack_size) { if(usedstack < -(ptrdiff_t)opt_codec_ctx->max_stack_size) {
......
...@@ -74,12 +74,28 @@ ber_fetch_length(int _is_constructed, void *bufptr, size_t size, ...@@ -74,12 +74,28 @@ ber_fetch_length(int _is_constructed, void *bufptr, size_t size,
} }
ssize_t ssize_t
ber_skip_length(int _is_constructed, void *ptr, size_t size) { ber_skip_length(asn_codec_ctx_t *opt_codec_ctx,
int _is_constructed, void *ptr, size_t size) {
ber_tlv_len_t vlen; /* Length of V in TLV */ ber_tlv_len_t vlen; /* Length of V in TLV */
ssize_t tl; /* Length of L in TLV */ ssize_t tl; /* Length of L in TLV */
ssize_t ll; /* Length of L in TLV */ ssize_t ll; /* Length of L in TLV */
size_t skip; size_t skip;
/*
* Make sure we didn't exceed the maximum stack size.
*/
if(opt_codec_ctx && opt_codec_ctx->max_stack_size) {
ptrdiff_t usedstack = ((char *)opt_codec_ctx - (char *)&size);
/* double negative is required to avoid int wrap-around */
if(usedstack > 0) usedstack = -usedstack;
ASN_DEBUG("Current stack size %ld", -(long)usedstack);
if(usedstack < -(ptrdiff_t)opt_codec_ctx->max_stack_size) {
ASN_DEBUG("Stack limit %ld reached",
(long)opt_codec_ctx->max_stack_size);
return -1;
}
}
/* /*
* Determine the size of L in TLV. * Determine the size of L in TLV.
*/ */
...@@ -107,7 +123,8 @@ ber_skip_length(int _is_constructed, void *ptr, size_t size) { ...@@ -107,7 +123,8 @@ ber_skip_length(int _is_constructed, void *ptr, size_t size) {
tl = ber_fetch_tag(ptr, size, &tag); tl = ber_fetch_tag(ptr, size, &tag);
if(tl <= 0) return tl; if(tl <= 0) return tl;
ll = ber_skip_length(BER_TLV_CONSTRUCTED(ptr), ll = ber_skip_length(opt_codec_ctx,
BER_TLV_CONSTRUCTED(ptr),
((char *)ptr) + tl, size - tl); ((char *)ptr) + tl, size - tl);
if(ll <= 0) return ll; if(ll <= 0) return ll;
......
...@@ -27,7 +27,10 @@ ssize_t ber_fetch_length(int _is_constructed, void *bufptr, size_t size, ...@@ -27,7 +27,10 @@ ssize_t ber_fetch_length(int _is_constructed, void *bufptr, size_t size,
* RETURN VALUES: * RETURN VALUES:
* Standard {-1,0,>0} convention. * Standard {-1,0,>0} convention.
*/ */
ssize_t ber_skip_length(int _is_constructed, void *bufptr, size_t size); struct asn_codec_ctx_s; /* Forward declaration */
ssize_t ber_skip_length(
struct asn_codec_ctx_s *opt_codec_ctx, /* optional context */
int _is_constructed, void *bufptr, size_t size);
/* /*
* This function serializes the length (L from TLV) in DER format. * This function serializes the length (L from TLV) in DER format.
......
...@@ -209,7 +209,7 @@ CHOICE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td, ...@@ -209,7 +209,7 @@ CHOICE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
ASN_DEBUG("Skipping unknown tag %s", ASN_DEBUG("Skipping unknown tag %s",
ber_tlv_tag_string(tlv_tag)); ber_tlv_tag_string(tlv_tag));
skip = ber_skip_length( skip = ber_skip_length(opt_codec_ctx,
BER_TLV_CONSTRUCTED(ptr), BER_TLV_CONSTRUCTED(ptr),
(char *)ptr + tag_len, LEFT - tag_len); (char *)ptr + tag_len, LEFT - tag_len);
......
...@@ -352,7 +352,7 @@ SEQUENCE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td, ...@@ -352,7 +352,7 @@ SEQUENCE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
/* Skip this tag */ /* Skip this tag */
ssize_t skip; ssize_t skip;
skip = ber_skip_length( skip = ber_skip_length(opt_codec_ctx,
BER_TLV_CONSTRUCTED(ptr), BER_TLV_CONSTRUCTED(ptr),
(char *)ptr + tag_len, LEFT - tag_len); (char *)ptr + tag_len, LEFT - tag_len);
ASN_DEBUG("Skip length %d in %s", ASN_DEBUG("Skip length %d in %s",
...@@ -474,7 +474,7 @@ SEQUENCE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td, ...@@ -474,7 +474,7 @@ SEQUENCE_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
RETURN(RC_FAIL); RETURN(RC_FAIL);
} }
ll = ber_skip_length( ll = ber_skip_length(opt_codec_ctx,
BER_TLV_CONSTRUCTED(ptr), BER_TLV_CONSTRUCTED(ptr),
(char *)ptr + tl, LEFT - tl); (char *)ptr + tl, LEFT - tl);
switch(ll) { switch(ll) {
......
...@@ -259,7 +259,7 @@ SET_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td, ...@@ -259,7 +259,7 @@ SET_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
ASN_DEBUG("Skipping unknown tag %s", ASN_DEBUG("Skipping unknown tag %s",
ber_tlv_tag_string(tlv_tag)); ber_tlv_tag_string(tlv_tag));
skip = ber_skip_length( skip = ber_skip_length(opt_codec_ctx,
BER_TLV_CONSTRUCTED(ptr), BER_TLV_CONSTRUCTED(ptr),
(char *)ptr + tag_len, LEFT - tag_len); (char *)ptr + tag_len, LEFT - tag_len);
...@@ -381,7 +381,7 @@ SET_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td, ...@@ -381,7 +381,7 @@ SET_decode_ber(asn_codec_ctx_t *opt_codec_ctx, asn_TYPE_descriptor_t *td,
RETURN(RC_FAIL); RETURN(RC_FAIL);
} }
ll = ber_skip_length( ll = ber_skip_length(opt_codec_ctx,
BER_TLV_CONSTRUCTED(ptr), BER_TLV_CONSTRUCTED(ptr),
(char *)ptr + tl, LEFT - tl); (char *)ptr + tl, LEFT - tl);
switch(ll) { switch(ll) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment