lib util ASN.1: Panic on ASN.1 tag mismatch
authorGary Lockyer <gary@catalyst.net.nz>
Tue, 28 Apr 2020 23:09:34 +0000 (11:09 +1200)
committerGary Lockyer <gary@samba.org>
Sun, 10 May 2020 21:45:38 +0000 (21:45 +0000)
If the ASN.1 depth is zero in asn1_end_tag, call smb_panic. Rather than
ignoring the condition.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
lib/util/asn1.c

index 397f6b3c271b6c9aa0f2c767c0477975f6677306..88d96d4544b1f834423d6c28e3ec994d1a90318d 100644 (file)
@@ -713,9 +713,10 @@ bool asn1_end_tag(struct asn1_data *data)
 {
        struct nesting *nesting;
 
-       if (data->depth > 0) {
-               data->depth--;
+       if (data->depth == 0) {
+               smb_panic("Unbalanced ASN.1 Tag nesting");
        }
+       data->depth--;
        /* make sure we read it all */
        if (asn1_tag_remaining(data) != 0) {
                data->has_error = true;