diff options
| author | Adam Langley <agl@google.com> | 2016-02-29 19:01:05 +0300 |
|---|---|---|
| committer | David Benjamin <davidben@google.com> | 2016-03-03 23:14:14 +0300 |
| commit | c02d05fe19c64568bec874bf2b187f8dca58d555 (patch) | |
| tree | ed57d174dbb1951b786b9e9caa62784b38790028 /crypto | |
| parent | 6d49157929abdefb155daf2751dc03fd9eb4240c (diff) | |
Fix encoding bug in i2c_ASN1_INTEGER
(Imported from upstream's 3661bb4e7934668bd99ca777ea8b30eedfafa871.)
Fix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as
negative.
Thanks to Huzaifa Sidhpurwala <huzaifas@redhat.com> and Hanno Böck
<hanno@hboeck.de> for reporting this issue.
BUG=590615
Change-Id: I8959e8ae01510a5924862a3f353be23130eee554
Reviewed-on: https://boringssl-review.googlesource.com/7199
Reviewed-by: David Benjamin <davidben@google.com>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/asn1/a_int.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c index 9790779a..38a01bcb 100644 --- a/crypto/asn1/a_int.c +++ b/crypto/asn1/a_int.c @@ -124,6 +124,8 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp) else { ret = a->length; i = a->data[0]; + if (ret == 1 && i == 0) + neg = 0; if (!neg && (i > 127)) { pad = 1; pb = 0; @@ -162,7 +164,7 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp) p += a->length - 1; i = a->length; /* Copy zeros to destination as long as source is zero */ - while (!*n) { + while (!*n && i > 1) { *(p--) = 0; n--; i--; |