This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new f97c3ca25d Validate more lengths in ASN1
f97c3ca25d is described below
commit f97c3ca25d89d850c8a9f8440b347cd2b8bf0a8e
Author: remm <[email protected]>
AuthorDate: Mon Aug 31 16:10:49 2026 +0200
Validate more lengths in ASN1
Found by code review.
---
java/org/apache/tomcat/util/buf/Asn1Parser.java | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/tomcat/util/buf/Asn1Parser.java
b/java/org/apache/tomcat/util/buf/Asn1Parser.java
index 7090bf30f8..defa1141be 100644
--- a/java/org/apache/tomcat/util/buf/Asn1Parser.java
+++ b/java/org/apache/tomcat/util/buf/Asn1Parser.java
@@ -100,6 +100,10 @@ public class Asn1Parser {
* @return the next tag byte value
*/
public int peekTag() {
+ if (pos >= source.length) {
+ throw new IllegalArgumentException(
+ sm.getString("asn1Parser.truncatedData",
Integer.valueOf(1), Integer.valueOf(0)));
+ }
return source[pos] & 0xFF;
}
@@ -175,6 +179,11 @@ public class Asn1Parser {
Integer.valueOf(source.length - pos)));
}
}
+ if (source.length - pos < len) {
+ throw new
IllegalArgumentException(sm.getString("asn1Parser.lengthInvalid",
Integer.valueOf(-1),
+ Integer.valueOf(source.length - pos)));
+ }
+
/*
* If this is the first length parsed after a sequence has been added
to the sequence nesting tracking mechanism
* it must be the length of the sequence so update the entry to record
the end position of the sequence. Note
@@ -182,10 +191,6 @@ public class Asn1Parser {
*/
if (nestedSequenceEndPositions.peekLast() != null &&
nestedSequenceEndPositions.peekLast().intValue() == -1) {
nestedSequenceEndPositions.pollLast();
- if (source.length - pos < len) {
- throw new
IllegalArgumentException(sm.getString("asn1Parser.lengthInvalid",
Integer.valueOf(-1),
- Integer.valueOf(source.length - pos)));
- }
nestedSequenceEndPositions.addLast(Integer.valueOf(pos + len));
}
return len;
@@ -283,6 +288,10 @@ public class Asn1Parser {
private int next() {
+ if (pos >= source.length) {
+ throw new IllegalArgumentException(
+ sm.getString("asn1Parser.truncatedData",
Integer.valueOf(1), Integer.valueOf(0)));
+ }
return source[pos++] & 0xFF;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
