tree 79155e37d71905ff68586ea16df4917361ca06e0
parent bab14fa753e9d429371c27aff0d4d077add90bf4
author David Benjamin <davidben@google.com> 1552606276 -0500
committer Adam Langley <agl@google.com> 1552929552 +0000

Harden the lower level parts of crypto/asn1 against overflows.

The legacy ASN.1 stack contains an unsalvageable mix of integer types.
82dfea8d9e65c4e57cc9fb2bd3f0dd49f5b31f45 bounded all inputs to the template
machinery, but sometimes code will call ASN1_get_object directly, such as the
just deleted d2i_ASN1_UINTEGER.

Thanks to mlbrown for reporting the d2i_ASN1_UINTEGER overflow.

Bug: chromium:942269
Change-Id: I2d4c8b7faf5dadd1b68dbdb51a5feae071ea2cb6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/35325
Reviewed-by: Adam Langley <agl@google.com>