mbedtls_asn1_get_bitstring_null: fix rejection of short inputs

Fix improper rejection of bitstrings with length less than 2.
This commit is contained in:
Gilles Peskine 2019-03-01 18:08:35 +01:00
parent f7d6acd475
commit e40d1207eb

View file

@ -230,8 +230,13 @@ int mbedtls_asn1_get_bitstring_null( unsigned char **p, const unsigned char *end
if( ( ret = mbedtls_asn1_get_tag( p, end, len, MBEDTLS_ASN1_BIT_STRING ) ) != 0 )
return( ret );
if( (*len)-- < 2 || *(*p)++ != 0 )
if( *len == 0 )
return( MBEDTLS_ERR_ASN1_INVALID_DATA );
--( *len );
if( **p != 0 )
return( MBEDTLS_ERR_ASN1_INVALID_DATA );
++( *p );
return( 0 );
}