Dear maintainers,
This patch ensures libtasn1 does not segfault when asked to delete an
unauthorized element (neither optional nor sequence of/set of).
This patch applies on top on my previous submitted patches.
That's the simplest patch I could come up with. But the logic could be
rewritten by testing first value element (instead of testing first type
element). Something like :
if (value == NULL)
{
if ((node->type & CONST_OPTION) && (len == 0))
...
else if ((type == ASN1_ETYPE_SEQUENCE_OF || type ==
ASN1_ETYPE_SET_OF) && (len == 0))
...
else
return ASN1_VALUE_NOT_VALID;
}
--
Jean-Louis Thekekara - OpenWide Ingénierie
http://ingenierie.openwide.fr
http://www.linuxembedded.fr
>From 55314083d43534d4fd50baeed0a4965a0a930b1a Mon Sep 17 00:00:00 2001
From: Jean-Louis Thekekara <[email protected]>
Date: Tue, 25 Mar 2014 17:15:58 +0100
Subject: [PATCH] asn1_write_value: fix segfault when deleting an unauthorized element
Segfaults can occur, since value is dereferenced later, ex:
352 if ((isdigit (value[0])) || (value[0] == '-')
---
lib/element.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/lib/element.c b/lib/element.c
index 3e26d84..ee77feb 100644
--- a/lib/element.c
+++ b/lib/element.c
@@ -303,6 +303,12 @@ asn1_write_value (asn1_node node_root, const char *name,
return ASN1_SUCCESS;
}
+ /* Don't allow element deletion for other types */
+ if (value == NULL)
+ {
+ return ASN1_VALUE_NOT_VALID;
+ }
+
switch (type)
{
case ASN1_ETYPE_BOOLEAN:
--
1.7.2.5
