Skip to content

Commit

Permalink
cryptobyte: reject Object Identifiers with leading 0x80
Browse files Browse the repository at this point in the history
Change-Id: Ie3a1b53e801077cd86963799e644b9783943933c
GitHub-Last-Rev: 6629bd7
GitHub-Pull-Request: #255
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/483955
Run-TryBot: Mateusz Poliwczak <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Ian Lance Taylor <[email protected]>
Auto-Submit: Ian Lance Taylor <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Run-TryBot: Ian Lance Taylor <[email protected]>
  • Loading branch information
mateusz834 authored and gopherbot committed Apr 12, 2023
1 parent 00fd4ff commit 1faeef9
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 0 deletions.
8 changes: 8 additions & 0 deletions cryptobyte/asn1.go
Original file line number Diff line number Diff line change
Expand Up @@ -431,6 +431,14 @@ func (s *String) readBase128Int(out *int) bool {
}
ret <<= 7
b := s.read(1)[0]

// ITU-T X.690, section 8.19.2:
// The subidentifier shall be encoded in the fewest possible octets,
// that is, the leading octet of the subidentifier shall not have the value 0x80.
if i == 0 && b == 0x80 {
return false
}

ret |= int(b & 0x7f)
if b&0x80 == 0 {
*out = ret
Expand Down
1 change: 1 addition & 0 deletions cryptobyte/asn1_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,7 @@ func TestASN1ObjectIdentifier(t *testing.T) {
{[]byte{6, 7, 85, 0x02, 0x85, 0xc7, 0xcc, 0xfb, 0x01}, true, []int{2, 5, 2, 1492336001}},
{[]byte{6, 7, 0x55, 0x02, 0x87, 0xff, 0xff, 0xff, 0x7f}, true, []int{2, 5, 2, 2147483647}}, // 2**31-1
{[]byte{6, 7, 0x55, 0x02, 0x88, 0x80, 0x80, 0x80, 0x00}, false, []int{}}, // 2**31
{[]byte{6, 3, 85, 0x80, 0x02}, false, []int{}}, // leading 0x80 octet
}

for i, test := range testData {
Expand Down

0 comments on commit 1faeef9

Please sign in to comment.