Fix a crash in the asn1parse command
authorBernd Edlinger <bernd.edlinger@hotmail.de>
Sat, 31 Mar 2018 19:09:32 +0000 (21:09 +0200)
committerBernd Edlinger <bernd.edlinger@hotmail.de>
Tue, 3 Apr 2018 14:02:16 +0000 (16:02 +0200)
Thanks to Sem Voigtländer for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/5826)

apps/asn1pars.c

index a391e0a..8906943 100644 (file)
@@ -226,7 +226,7 @@ int asn1parse_main(int argc, char **argv)
             ASN1_TYPE *atmp;
             int typ;
             j = atoi(sk_OPENSSL_STRING_value(osk, i));
-            if (j == 0) {
+            if (j <= 0 || j >= tmplen) {
                 BIO_printf(bio_err, "'%s' is an invalid number\n",
                            sk_OPENSSL_STRING_value(osk, i));
                 continue;