tree c071d387eb2d64105680aff777075cd177e7f587
parent d0beda01f9d0abfaf35ab24089ed219e756add01
author Martin Kreichgauer <martinkr@google.com> 1502756114 -0700
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1504735106 +0000

Fix overflow in c2i_ASN1_BIT_STRING.

c2i_ASN1_BIT_STRING takes length as a long but uses it as an int. Check bounds
before doing so. Previously, excessively large inputs to the function could
write a single byte outside the target buffer. (This is unreachable as
asn1_ex_c2i already uses int for the length.)

Thanks to NCC for finding this issue.

Change-Id: I7ae42214ca620d4159fa01c942153717a7647c65
Reviewed-on: https://boringssl-review.googlesource.com/19204
Reviewed-by: Martin Kreichgauer <martinkr@google.com>
Commit-Queue: Martin Kreichgauer <martinkr@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>