Chris Wright ddb2c43594 asn1: additional sanity checking during BER decoding
- Don't trust a length which is greater than the working buffer.
  An invalid length could cause overflow when calculating buffer size
  for decoding oid.

- An oid length of zero is invalid and allows for an off-by-one error when
  decoding oid because the first subid actually encodes first 2 subids.

- A primitive encoding may not have an indefinite length.

Thanks to Wei Wang from McAfee for report.

Cc: Steven French <sfrench@us.ibm.com>
Cc: stable@kernel.org
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-06-05 14:24:54 -07:00
..
2008-05-14 19:23:27 -05:00
2008-02-08 09:22:40 -08:00
2008-05-01 08:04:01 -07:00
2008-04-29 08:06:04 -07:00
2008-05-19 15:37:27 -05:00
2008-04-29 08:06:00 -07:00
2008-05-24 09:56:07 -07:00
2008-04-30 08:29:52 -07:00
2008-02-08 09:22:40 -08:00
2008-05-21 16:55:58 -07:00
2008-04-29 08:06:18 -07:00
2008-05-24 09:56:08 -07:00
2008-04-30 08:29:51 -07:00
2008-04-30 08:29:52 -07:00
2008-04-29 08:06:17 -07:00
2008-05-07 18:35:03 +02:00
2008-04-30 08:29:47 -07:00
2008-05-01 13:08:16 -04:00
2008-05-01 13:08:50 -04:00
2008-05-01 13:08:16 -04:00
2008-05-01 13:08:16 -04:00
2008-05-06 13:13:37 -07:00
2008-04-29 08:06:00 -07:00
2008-04-30 13:38:47 +02:00
2008-04-29 08:06:01 -07:00
2008-02-14 21:13:33 -08:00
2008-05-01 13:08:16 -04:00
2008-05-08 10:46:56 -07:00
2008-04-30 08:29:51 -07:00
2008-05-01 13:08:16 -04:00
2008-05-01 13:08:50 -04:00
2008-02-14 21:13:33 -08:00
2008-04-29 08:06:00 -07:00
2008-05-01 13:08:50 -04:00