tree affbfa57e4f6bc8524ab01e1608f0d00a6e4937f
parent 7e8ed440135c166d0a29e28548b485b66d1645b8
author David Benjamin <davidben@google.com> 1456778579 -0500
committer Adam Langley <agl@google.com> 1456780639 +0000

ASN1_get_object should not accept large universal tags.

The high bits of the type get used for the V_ASN1_NEG bit, so when used with
ASN1_ANY/ASN1_TYPE, universal tags become ambiguous. This allows one to create
a negative zero, which should be impossible. Impose an upper bound on universal
tags accepted by crypto/asn1 and add a test.

BUG=590615

Change-Id: I363e01ebfde621c8865101f5bcbd5f323fb59e79
Reviewed-on: https://boringssl-review.googlesource.com/7238
Reviewed-by: Adam Langley <agl@google.com>