david/ipxe
david
/
ipxe
Archived
1
0
Fork 0
Code

[crypto] Allow for zero-length ASN.1 cursors 

The assumption in asn1_type() that an ASN.1 cursor will always contain
a type byte is incorrect.  A cursor that has been cleanly invalidated
via asn1_invalidate_cursor() will contain a type byte, but there are
other ways in which to arrive at a zero-length cursor.

Fix by explicitly checking the cursor length in asn1_type().  This
allows asn1_invalidate_cursor() to be reduced to simply zeroing the
length field.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown 2016-03-11 16:51:13 +00:00
parent 05dcb07cb2
commit 5a6ed90a00
2 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/crypto/asn1.c
View File

@ -81,18 +81,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
#define EINFO_ENOTTY_ALGORITHM \
__einfo_uniqify ( EINFO_ENOTTY, 0x01, "Inappropriate algorithm" )
/**
* Invalidate ASN.1 object cursor
*
* @v cursor ASN.1 object cursor
*/
void asn1_invalidate_cursor ( struct asn1_cursor *cursor ) {
static uint8_t asn1_invalid_object[] = { ASN1_END, 0 };
cursor->data = asn1_invalid_object;
cursor->len = 0;
}
/**
* Start parsing ASN.1 object
*

16
src/include/ipxe/asn1.h
View File

@ -314,15 +314,27 @@ struct asn1_bit_string {
unsigned int unused;
} __attribute__ (( packed ));
/**
* Invalidate ASN.1 object cursor
*
* @v cursor ASN.1 object cursor
*/
static inline __attribute__ (( always_inline )) void
asn1_invalidate_cursor ( struct asn1_cursor *cursor ) {
cursor->len = 0;
}
/**
* Extract ASN.1 type
*
* @v cursor ASN.1 object cursor
* @ret type Type
* @ret type Type, or ASN1_END if cursor is invalid
*/
static inline __attribute__ (( always_inline )) unsigned int
asn1_type ( const struct asn1_cursor *cursor ) {
return ( *( ( const uint8_t * ) cursor->data ) );
const uint8_t *type = cursor->data;
return ( ( cursor->len >= sizeof ( *type ) ) ? *type : ASN1_END );
}
extern void asn1_invalidate_cursor ( struct asn1_cursor *cursor );