0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibCrypto: Fail with overflow when bitfield has too many unused bits

Browse source 
There cannot be more unused bits than the entirety of the input.
Found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31706#c1
This commit is contained in:
AnotherTest 2021-03-08 10:50:40 +03:30 • committed by Andreas Kling
parent f9f9cda025
commit 8cc279ed74
Notes: sideshowbarker 2024-07-18 21:38:14 +09:00
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
Userland/Libraries/LibCrypto/ASN1/DER.cpp
View file

@ -196,7 +196,12 @@ Result<const BitmapView, DecodeError> Decoder::decode_bit_string(ReadonlyBytes d
return DecodeError::InvalidInputFormat;
auto unused_bits = data[0];
return BitmapView { const_cast<u8*>(data.offset_pointer(1)), data.size() * 8 - unused_bits };
auto total_size_in_bits = data.size() * 8;
if (unused_bits > total_size_in_bits)
return DecodeError::Overflow;
return BitmapView { const_cast<u8*>(data.offset_pointer(1)), total_size_in_bits - unused_bits };
}
Result<Tag, DecodeError> Decoder::peek()