From 708c358a745fa5e0f1bc142c3371b1a292423eb7 Mon Sep 17 00:00:00 2001
From: leitner <leitner>
Date: Tue, 15 Apr 2014 20:12:50 +0000
Subject: [PATCH] for asn1derlength: save a few bytes for asn1dertag: catch
 too-large-value overflow

---
 scan/scan_asn1derlength.c |  2 +-
 scan/scan_asn1dertag.c    | 22 +++++++++++++++++++---
 test/marshal.c            |  1 +
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/scan/scan_asn1derlength.c b/scan/scan_asn1derlength.c
index 7d2ee91..60c604a 100644
--- a/scan/scan_asn1derlength.c
+++ b/scan/scan_asn1derlength.c
@@ -2,7 +2,7 @@
 
 size_t scan_asn1derlengthvalue(const char* src,size_t len,unsigned long long* value) {
   if (len==0 || len>=-(uintptr_t)src) return 0;
-  unsigned char i,c=*src;
+  unsigned int i,c=*src;
   unsigned long long l;
   if ((c&0x80)==0) {
     *value=c&0x7f;
diff --git a/scan/scan_asn1dertag.c b/scan/scan_asn1dertag.c
index 17b6044..7c5e7c1 100644
--- a/scan/scan_asn1dertag.c
+++ b/scan/scan_asn1dertag.c
@@ -2,14 +2,30 @@
 
 size_t scan_asn1dertag(const char* src,size_t len,unsigned long long* length) {
   size_t n;
-  unsigned long long l=0;
-  for (n=0; n<len; ++n) {
+  unsigned long long l;
+  unsigned int bits=0;
+  if (len==0) return 0;
+  {
+    unsigned int k=src[0]&0x7f;
+    if (!(src[0]&0x80)) {
+      *length=k;
+      return 1;
+    }
+    if (!(l=k)) return 0;	// non-minimal encoding
+    while (k) {	// count bits in leading byte
+      ++bits;
+      k>>=1;
+    }
+    bits=sizeof(l)*8-bits;
+  }
+  for (n=1; n<len; ++n) {
+    if (bits<7) return 0;
+    bits-=7;
     l=(l<<7) | (src[n]&0x7f);
     if (!(src[n]&0x80)) {
       *length=l;
       return n+1;
     }
-    if (n==0 && !l) return 0;	// DER says: must be encoded minimally
   }
   return 0;
 }
diff --git a/test/marshal.c b/test/marshal.c
index d4e9e9e..bc20702 100644
--- a/test/marshal.c
+++ b/test/marshal.c
@@ -139,6 +139,7 @@ int main() {
   ull=-1; assert(scan_asn1dertag("\x80\x42_",3,&ull)==0 && ull==-1);	// non-minimal encoding
   ull=-1; assert(scan_asn1dertag("\x80_",1,&ull)==0 && ull==-1);	// incomplete sequence
   ull=-1; assert(scan_asn1dertag("\x82\x80_",2,&ull)==0 && ull==-1);	// incomplete sequence
+  ull=-1; assert(scan_asn1dertag("\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",10,&ull)==0 && ull==-1);	// value too large
 
   ull=-1; assert(scan_asn1derlength("\x00_",2,&ull)==1 && ull==0);
   ull=-1; assert(scan_asn1derlengthvalue("\x81\xc2_",3,&ull)==2 && ull==0xc2);