package/cryptopp/0001-Fix-possible-DoS-in-ASN.1-decoders-CVE-2016-9939.patch

   1 From 3d9181d7bdd8e491f745dbc9e34bd20b6f6da069 Mon Sep 17 00:00:00 2001
   2 From: Gergely Nagy <ngg@tresorit.com>
   3 Date: Wed, 14 Dec 2016 13:19:01 +0100
   4 Subject: [PATCH] Fix possible DoS in ASN.1 decoders (CVE-2016-9939)
   5
   6 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
   7 ---
   8  asn.cpp | 10 ++++++++++
   9  asn.h   |  2 ++
  10  2 files changed, 12 insertions(+)
  11
  12 diff --git a/asn.cpp b/asn.cpp
  13 index 297ff01..2e923ef 100644
  14 --- a/asn.cpp
  15 +++ b/asn.cpp
  16 @@ -123,6 +123,8 @@ size_t BERDecodeOctetString(BufferedTransformation &bt, SecByteBlock &str)
  17         size_t bc;
  18         if (!BERLengthDecode(bt, bc))
  19                 BERDecodeError();
  20 +       if (bc > bt.MaxRetrievable())
  21 +               BERDecodeError();
  22
  23         str.New(bc);
  24         if (bc != bt.Get(str, bc))
  25 @@ -139,6 +141,8 @@ size_t BERDecodeOctetString(BufferedTransformation &bt, BufferedTransformation &
  26         size_t bc;
  27         if (!BERLengthDecode(bt, bc))
  28                 BERDecodeError();
  29 +       if (bc > bt.MaxRetrievable())
  30 +               BERDecodeError();
  31
  32         bt.TransferTo(str, bc);
  33         return bc;
  34 @@ -161,6 +165,8 @@ size_t BERDecodeTextString(BufferedTransformation &bt, std::string &str, byte as
  35         size_t bc;
  36         if (!BERLengthDecode(bt, bc))
  37                 BERDecodeError();
  38 +       if (bc > bt.MaxRetrievable())
  39 +               BERDecodeError();
  40
  41         SecByteBlock temp(bc);
  42         if (bc != bt.Get(temp, bc))
  43 @@ -188,6 +194,10 @@ size_t BERDecodeBitString(BufferedTransformation &bt, SecByteBlock &str, unsigne
  44         size_t bc;
  45         if (!BERLengthDecode(bt, bc))
  46                 BERDecodeError();
  47 +       if (bc == 0)
  48 +               BERDecodeError();
  49 +       if (bc > bt.MaxRetrievable())
  50 +               BERDecodeError();
  51
  52         byte unused;
  53         if (!bt.Get(unused))
  54 diff --git a/asn.h b/asn.h
  55 index ed9de52..33f0dd0 100644
  56 --- a/asn.h
  57 +++ b/asn.h
  58 @@ -498,6 +498,8 @@ void BERDecodeUnsigned(BufferedTransformation &in, T &w, byte asnTag = INTEGER,
  59         bool definite = BERLengthDecode(in, bc);
  60         if (!definite)
  61                 BERDecodeError();
  62 +       if (bc > in.MaxRetrievable())
  63 +               BERDecodeError();
  64
  65         SecByteBlock buf(bc);
  66
  67 --
  68 2.10.2
  69