tree bc6ef52b4e82da01780808e0dfcd2a3d09bf91eb
parent 65be20fe2fccad661d02c36fdeaa66a6cd35104a
author David Benjamin <davidben@google.com> 1456778579 -0500
committer Adam Langley <agl@google.com> 1457043234 +0000

ASN1_get_object should not accept large universal tags.

The high bits of the type get used for the V_ASN1_NEG bit, so when used with
ASN1_ANY/ASN1_TYPE, universal tags become ambiguous. This allows one to create
a negative zero, which should be impossible. Impose an upper bound on universal
tags accepted by crypto/asn1 and add a test.

BUG=590615

(Cherry-picked from fb2c6f8c8565e1e2d85c24408050c96521acbcdc.)

Change-Id: Ia988acf73fd11807869510a2b3825637a8d98853
Reviewed-on: https://boringssl-review.googlesource.com/7298
Reviewed-by: Adam Langley <agl@google.com>