summaryrefslogtreecommitdiff
path: root/fs/cifs/asn1.c
diff options
context:
space:
mode:
authorIngo Molnar <mingo@elte.hu>2008-06-16 10:17:15 +0200
committerIngo Molnar <mingo@elte.hu>2008-06-16 10:17:15 +0200
commit28638ea4f8adb63f837e4436560ab16ab0388587 (patch)
tree2dab7a03d7696697c82ba62a03700d3a2f3639b1 /fs/cifs/asn1.c
parentf781b03c4b1c713ac000877c8bbc31fc4164a29b (diff)
parent066519068ad2fbe98c7f45552b1f592903a9c8c8 (diff)
Merge branch 'linus' into x86/nmitip-x86-nmi-2008-06-16_09.20_Mon
Conflicts: arch/x86/kernel/nmi_32.c
Diffstat (limited to 'fs/cifs/asn1.c')
-rw-r--r--fs/cifs/asn1.c14
1 files changed, 14 insertions, 0 deletions
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cb52cbbe45ff..f58e41d3ba48 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
}
}
}
+
+ /* don't trust len bigger than ctx buffer */
+ if (*len > ctx->end - ctx->pointer)
+ return 0;
+
return 1;
}
@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
if (!asn1_length_decode(ctx, &def, &len))
return 0;
+ /* primitive shall be definite, indefinite shall be constructed */
+ if (*con == ASN1_PRI && !def)
+ return 0;
+
if (def)
*eoc = ctx->pointer + len;
else
@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
unsigned long *optr;
size = eoc - ctx->pointer + 1;
+
+ /* first subid actually encodes first two subids */
+ if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+ return 0;
+
*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
if (*oid == NULL)
return 0;