From 62bab9a7a2adbe3f1b7960a35d7dab1d7119c639 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Gustavsson?= Date: Mon, 29 Sep 2014 12:55:21 +0200 Subject: BER decoding: Don't allow primitives with indefinite lengths According to the BER encoding rules, only constructed values may have indefinite lengths. A primitive value must be encoded with a definite length. Reported-by: Simon Cornish --- lib/asn1/c_src/asn1_erl_nif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/asn1/c_src') diff --git a/lib/asn1/c_src/asn1_erl_nif.c b/lib/asn1/c_src/asn1_erl_nif.c index 53e3aa1678..317a464060 100644 --- a/lib/asn1/c_src/asn1_erl_nif.c +++ b/lib/asn1/c_src/asn1_erl_nif.c @@ -949,7 +949,7 @@ static int ber_decode_value(ErlNifEnv* env, ERL_NIF_TERM *value, unsigned char * } else if (in_buf[*ib_index] == ASN1_INDEFINITE_LENGTH) { (*ib_index)++; curr_head = enif_make_list(env, 0); - if (*ib_index+1 >= in_buf_len) { + if (*ib_index+1 >= in_buf_len || form == ASN1_PRIMITIVE) { return ASN1_INDEF_LEN_ERROR; } while (!(in_buf[*ib_index] == 0 && in_buf[*ib_index + 1] == 0)) { -- cgit v1.2.3