diff options
| -rw-r--r-- | src/lib/krb5/asn.1/ChangeLog | 5 | ||||
| -rw-r--r-- | src/lib/krb5/asn.1/asn1_get.c | 2 |
2 files changed, 7 insertions, 0 deletions
diff --git a/src/lib/krb5/asn.1/ChangeLog b/src/lib/krb5/asn.1/ChangeLog index e1b6743d06..8dace6e09f 100644 --- a/src/lib/krb5/asn.1/ChangeLog +++ b/src/lib/krb5/asn.1/ChangeLog @@ -1,3 +1,8 @@ +2002-06-24 Tom Yu <tlyu@mit.edu> + + * asn1_get.c (asn1_get_length): Check for negative length. + [pullup from 1-2-2-branch] + 2002-04-09 Ken Raeburn <raeburn@mit.edu> * asn1buf.c (asn1buf_remove_octetstring, diff --git a/src/lib/krb5/asn.1/asn1_get.c b/src/lib/krb5/asn.1/asn1_get.c index fc945f115e..1652db109d 100644 --- a/src/lib/krb5/asn.1/asn1_get.c +++ b/src/lib/krb5/asn.1/asn1_get.c @@ -145,6 +145,8 @@ asn1_error_code asn1_get_length(buf, retlen, indef) if(retval) return retval; len = (len<<8) + (int)o; } + if (len < 0) + return ASN1_OVERRUN; if (indef != NULL && !len) *indef = 1; if(retlen != NULL) *retlen = len; |