]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
asn1: additional sanity checking during BER decoding
authorChris Wright <chrisw@sous-sol.org>
Wed, 4 Jun 2008 16:16:33 +0000 (09:16 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Thu, 5 Jun 2008 21:24:54 +0000 (14:24 -0700)
commitddb2c43594f22843e9f3153da151deaba1a834c5
tree7eeeca2fa55e9ef45c381b01d9e3ec1b726297c1
parentefedf51c866130945b5db755cb58670e60205d83
asn1: additional sanity checking during BER decoding

- Don't trust a length which is greater than the working buffer.
  An invalid length could cause overflow when calculating buffer size
  for decoding oid.

- An oid length of zero is invalid and allows for an off-by-one error when
  decoding oid because the first subid actually encodes first 2 subids.

- A primitive encoding may not have an indefinite length.

Thanks to Wei Wang from McAfee for report.

Cc: Steven French <sfrench@us.ibm.com>
Cc: stable@kernel.org
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/cifs/asn1.c
net/ipv4/netfilter/nf_nat_snmp_basic.c