Skip to content
Snippets Groups Projects
Commit c593ae84 authored by Nikos Mavrogiannopoulos's avatar Nikos Mavrogiannopoulos
Browse files

_asn1_decode_simple_ber: restrict the levels of recursion to 3


On indefinite string decoding, setting a maximum level of recursions
protects the BER decoder from a stack exhaustion due to large amounts
of recursion.

Signed-off-by: default avatarNikos Mavrogiannopoulos <nmav@redhat.com>
parent 0e74cc96
No related branches found
No related tags found
No related merge requests found
......@@ -45,6 +45,13 @@
#define DECODE_FLAG_HAVE_TAG 1
#define DECODE_FLAG_INDEFINITE (1<<1)
/* On indefinite string decoding, allow this maximum levels
* of recursion. Allowing infinite recursion, makes the BER
* decoder susceptible to stack exhaustion due to that recursion.
*/
#define DECODE_FLAG_LEVEL1 (1<<2)
#define DECODE_FLAG_LEVEL2 (1<<3)
#define DECODE_FLAG_LEVEL3 (1<<4)
#define DECR_LEN(l, s) do { \
l -= s; \
......@@ -2216,7 +2223,8 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der,
}
/* indefinite constructed */
if (((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype))
if ((((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) &&
!(dflags & DECODE_FLAG_LEVEL3))
{
len_len = 1;
......@@ -2236,8 +2244,17 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der,
do
{
unsigned tmp_len;
unsigned flags = DECODE_FLAG_HAVE_TAG;
if (dflags & DECODE_FLAG_LEVEL1)
flags |= DECODE_FLAG_LEVEL2;
else if (dflags & DECODE_FLAG_LEVEL2)
flags |= DECODE_FLAG_LEVEL3;
else
flags |= DECODE_FLAG_LEVEL1;
result = asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len);
result = _asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len,
flags);
if (result != ASN1_SUCCESS)
{
warn();
......
  • It makes sense to me after inspecting some other changes in tmp-protect-ber-decoder-from-recursion2. What would be probably good to add is the description of dflags parameter of _asn1_decode_simple_ber, but maybe in different commit.

  • @ep69 I've added a comment set documenting the options. Thank you.

0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment