瀏覽代碼

[crypto] Avoid an error when asn1_shrink() is already at end of object

asn1_skip() will return an error on reaching the end of an object, and
so should not be used as the basis for asn1_shrink().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 12 年之前
父節點
當前提交
2cd24473b8
共有 1 個文件被更改,包括 12 次插入7 次删除
  1. 12
    7
      src/crypto/asn1.c

+ 12
- 7
src/crypto/asn1.c 查看文件

@@ -220,16 +220,21 @@ int asn1_skip ( struct asn1_cursor *cursor, unsigned int type ) {
220 220
  * invalidated.
221 221
  */
222 222
 int asn1_shrink ( struct asn1_cursor *cursor, unsigned int type ) {
223
-	struct asn1_cursor next;
224
-	int rc;
223
+	struct asn1_cursor temp;
224
+	const void *end;
225
+	int len;
225 226
 
226
-	/* Skip to next object */
227
-	memcpy ( &next, cursor, sizeof ( next ) );
228
-	if ( ( rc = asn1_skip ( &next, type ) ) != 0 )
229
-		return rc;
227
+	/* Find end of object */
228
+	memcpy ( &temp, cursor, sizeof ( temp ) );
229
+	len = asn1_start ( &temp, type );
230
+	if ( len < 0 ) {
231
+		asn1_invalidate_cursor ( cursor );
232
+		return len;
233
+	}
234
+	end = ( temp.data + len );
230 235
 
231 236
 	/* Shrink original cursor to contain only its first object */
232
-	cursor->len = ( next.data - cursor->data );
237
+	cursor->len = ( end - cursor->data );
233 238
 
234 239
 	return 0;
235 240
 }

Loading…
取消
儲存