Limit depth of ASN1 parse printing.

Thanks to Guido Vranken <guidovranken@gmail.com> for reporting this issue.

Reviewed-by: Tim Hudson <tjh@openssl.org>

diff --git a/crypto/asn1/asn1_par.c b/crypto/asn1/asn1_par.c
index 9a370cd4bc7621458fc9740c2d4078918ba7537a..09dde156137cf1975fa40d6f2ef30222507a3aed 100644 (file)
--- a/crypto/asn1/asn1_par.c
+++ b/crypto/asn1/asn1_par.c
@@ -62,6 +62,10 @@
 #include <openssl/objects.h>
 #include <openssl/asn1.h>
 
 #include <openssl/objects.h>
 #include <openssl/asn1.h>
 

+#ifndef ASN1_PARSE_MAXDEPTH
+#define ASN1_PARSE_MAXDEPTH 128
+#endif
+

 static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
                            int indent);
 static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
 static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
                            int indent);
 static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,


@@ -123,6 +127,11 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
     /* ASN1_BMPSTRING *bmp=NULL; */
     int dump_indent;
 
     /* ASN1_BMPSTRING *bmp=NULL; */
     int dump_indent;
 

+    if (depth > ASN1_PARSE_MAXDEPTH) {
+            BIO_puts(bp, "BAD RECURSION DEPTH\n");
+            goto end;
+    }
+

     dump_indent = 6;            /* Because we know BIO_dump_indent() */
     p = *pp;
     tot = p + length;
     dump_indent = 6;            /* Because we know BIO_dump_indent() */
     p = *pp;
     tot = p + length;