diff options
author | Michael Brown <mcb30@ipxe.org> | 2016-03-11 16:51:13 +0000 |
---|---|---|
committer | Michael Brown <mcb30@ipxe.org> | 2016-03-11 16:58:51 +0000 |
commit | 5a6ed90a00ea8b1070c808e4f7d5da173b2e848f (patch) | |
tree | 65c60b99af5ea48cd8d81cf13152854d0fdbebff /src/include/ipxe | |
parent | 05dcb07cb239d8b7abe33f7701dbb81f370cea4b (diff) | |
download | ipxe-5a6ed90a00ea8b1070c808e4f7d5da173b2e848f.zip ipxe-5a6ed90a00ea8b1070c808e4f7d5da173b2e848f.tar.gz ipxe-5a6ed90a00ea8b1070c808e4f7d5da173b2e848f.tar.bz2 |
[crypto] Allow for zero-length ASN.1 cursors
The assumption in asn1_type() that an ASN.1 cursor will always contain
a type byte is incorrect. A cursor that has been cleanly invalidated
via asn1_invalidate_cursor() will contain a type byte, but there are
other ways in which to arrive at a zero-length cursor.
Fix by explicitly checking the cursor length in asn1_type(). This
allows asn1_invalidate_cursor() to be reduced to simply zeroing the
length field.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/include/ipxe')
-rw-r--r-- | src/include/ipxe/asn1.h | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/src/include/ipxe/asn1.h b/src/include/ipxe/asn1.h index 5fbd582..2e635b4 100644 --- a/src/include/ipxe/asn1.h +++ b/src/include/ipxe/asn1.h @@ -315,14 +315,26 @@ struct asn1_bit_string { } __attribute__ (( packed )); /** + * Invalidate ASN.1 object cursor + * + * @v cursor ASN.1 object cursor + */ +static inline __attribute__ (( always_inline )) void +asn1_invalidate_cursor ( struct asn1_cursor *cursor ) { + cursor->len = 0; +} + +/** * Extract ASN.1 type * * @v cursor ASN.1 object cursor - * @ret type Type + * @ret type Type, or ASN1_END if cursor is invalid */ static inline __attribute__ (( always_inline )) unsigned int asn1_type ( const struct asn1_cursor *cursor ) { - return ( *( ( const uint8_t * ) cursor->data ) ); + const uint8_t *type = cursor->data; + + return ( ( cursor->len >= sizeof ( *type ) ) ? *type : ASN1_END ); } extern void asn1_invalidate_cursor ( struct asn1_cursor *cursor ); |