diff options
author | Chris Wright <chrisw@sous-sol.org> | 2008-06-04 09:16:33 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-06-05 14:24:54 -0700 |
commit | ddb2c43594f22843e9f3153da151deaba1a834c5 (patch) | |
tree | 7eeeca2fa55e9ef45c381b01d9e3ec1b726297c1 /net/dccp/feat.h | |
parent | efedf51c866130945b5db755cb58670e60205d83 (diff) |
asn1: additional sanity checking during BER decoding
- Don't trust a length which is greater than the working buffer.
An invalid length could cause overflow when calculating buffer size
for decoding oid.
- An oid length of zero is invalid and allows for an off-by-one error when
decoding oid because the first subid actually encodes first 2 subids.
- A primitive encoding may not have an indefinite length.
Thanks to Wei Wang from McAfee for report.
Cc: Steven French <sfrench@us.ibm.com>
Cc: stable@kernel.org
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'net/dccp/feat.h')
0 files changed, 0 insertions, 0 deletions