wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-28 12:30:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix missing check

Browse Source
This commit is contained in:
Sergio R. Caprile committed 2026-07-13 14:52:26 -03:00
1 parent f52e4f4bb0
commit a8b4ae95db
2 files changed
+4 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

mongoose.c
+2 -4
View File
@@ -16223,16 +16223,14 @@ static int mg_der_to_tlv(uint8_t *der, size_t dersz, struct mg_der_tlv *tlv) {
if (tlv->len > 0x7f) { // long-form length if (tlv->len > 0x7f) { // long-form length
uint32_t i; uint32_t i;
n = tlv->len - 0x80; n = tlv->len - 0x80;
if (n > 4 || dersz < (2 + n)) return -1; if (n == 0 || n > 4 || dersz < (2 + n)) return -1;
tlv->len = 0; tlv->len = 0;
for (i = 0; i < n; i++) { for (i = 0; i < n; i++) {
tlv->len = (tlv->len << 8) | der[2 + i]; tlv->len = (tlv->len << 8) | der[2 + i];
} }
if (n > (dersz - 2)) return -1;
tlv->value += n; tlv->value += n;
} else {
if (der + dersz < tlv->value + tlv->len) return -1;
} }
if (tlv->len > dersz - (size_t) (tlv->value - der)) return -1;
return (int) n; return (int) n;
} }
src/tls_builtin.c
+2 -4
View File
@@ -194,16 +194,14 @@ static int mg_der_to_tlv(uint8_t *der, size_t dersz, struct mg_der_tlv *tlv) {
if (tlv->len > 0x7f) { // long-form length if (tlv->len > 0x7f) { // long-form length
uint32_t i; uint32_t i;
n = tlv->len - 0x80; n = tlv->len - 0x80;
if (n > 4 || dersz < (2 + n)) return -1; if (n == 0 || n > 4 || dersz < (2 + n)) return -1;
tlv->len = 0; tlv->len = 0;
for (i = 0; i < n; i++) { for (i = 0; i < n; i++) {
tlv->len = (tlv->len << 8) | der[2 + i]; tlv->len = (tlv->len << 8) | der[2 + i];
} }
if (n > (dersz - 2)) return -1;
tlv->value += n; tlv->value += n;
} else {
if (der + dersz < tlv->value + tlv->len) return -1;
} }
if (tlv->len > dersz - (size_t) (tlv->value - der)) return -1;
return (int) n; return (int) n;
} }