Gilles Peskine 37570e8152 mbedtls_asn1_get_int: fix int overflow ...

Fix a signed int overflow in mbedtls_asn1_get_int() for numbers
between INT_MAX+1 and UINT_MAX (typically 0x80000000..0xffffffff).
This was undefined behavior which in practice would typically have
resulted in an incorrect value, but which may plausibly also have
caused the postcondition (*p == initial<*p> + len) to be violated.

Credit to OSS-Fuzz.

2019-10-10 19:29:27 +02:00

9.7 KiB

Raw Blame History

View Raw