Cast to an unsigned type before negating
authorKurt Roeckx <kurt@roeckx.be>
Fri, 11 Nov 2016 20:41:50 +0000 (21:41 +0100)
committerKurt Roeckx <kurt@roeckx.be>
Sat, 12 Nov 2016 13:07:31 +0000 (14:07 +0100)
llvm's ubsan reported:
runtime error: negation of -9223372036854775808 cannot be represented in
type 'int64_t' (aka 'long'); cast to an unsigned type to negate this
value to itself

Found using libfuzzer

Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1908

crypto/asn1/a_int.c

index 36248df92d8a8301f5286dd086ac07385022ab3e..833322e89bac145efda755566a75856734522965 100644 (file)
@@ -289,7 +289,7 @@ static int asn1_get_int64(int64_t *pr, const unsigned char *b, size_t blen,
             ASN1err(ASN1_F_ASN1_GET_INT64, ASN1_R_TOO_SMALL);
             return 0;
         }
             ASN1err(ASN1_F_ASN1_GET_INT64, ASN1_R_TOO_SMALL);
             return 0;
         }
-        *pr = -(int64_t)r;
+        *pr = -(uint64_t)r;
     } else {
         if (r > INT64_MAX) {
             ASN1err(ASN1_F_ASN1_GET_INT64, ASN1_R_TOO_LARGE);
     } else {
         if (r > INT64_MAX) {
             ASN1err(ASN1_F_ASN1_GET_INT64, ASN1_R_TOO_LARGE);