commit c4eec0c16b02c97a62a95b6a08656c3a9ddb6baa
author Adam Langley <agl@google.com> Mon Feb 29 08:01:05 2016 -0800
committer David Benjamin <davidben@google.com> Mon Feb 29 20:07:03 2016 +0000
tree dc974ff4a27ac0b9c0b446444b08792787be52ff
parent b944882f26d64881161622b6c708568ff67483dd

Fix encoding bug in i2c_ASN1_INTEGER

(Imported from upstream's 3661bb4e7934668bd99ca777ea8b30eedfafa871.)

Fix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as
negative.

Thanks to Huzaifa Sidhpurwala <huzaifas@redhat.com> and Hanno Böck
<hanno@hboeck.de> for reporting this issue.

BUG=590615

Change-Id: I8959e8ae01510a5924862a3f353be23130eee554
Reviewed-on: https://boringssl-review.googlesource.com/7199
Reviewed-by: David Benjamin <davidben@google.com>

crypto/asn1/a_int.c

diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c
index 9790779..38a01bc 100644
--- a/crypto/asn1/a_int.c
+++ b/crypto/asn1/a_int.c
@@ -124,6 +124,8 @@
     else {
         ret = a->length;
         i = a->data[0];
+        if (ret == 1 && i == 0)
+            neg = 0;
         if (!neg && (i > 127)) {
             pad = 1;
             pb = 0;
@@ -162,7 +164,7 @@
         p += a->length - 1;
         i = a->length;
         /* Copy zeros to destination as long as source is zero */
-        while (!*n) {
+        while (!*n && i > 1) {
             *(p--) = 0;
             n--;
             i--;