help-libtasn1
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

_asn1_expand_object_id uses null pointer as string


From: Pascal Cuoq
Subject: _asn1_expand_object_id uses null pointer as string
Date: Thu, 7 Apr 2016 10:03:38 +0000

Here is a minor issue with no security consequences (the description file is 
not usually under the control of an attacker).

With the specially crafted ASN.1 description attached to this message, using 
the current git version, the function _asn1_expand_object_id, at line 797, 
passes a null pointer as p4->value to the function _asn1_str_cat, which expects 
a pointer to a string: 
http://git.savannah.gnu.org/cgit/libtasn1.git/tree/lib/parser_aux.c?id=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625#n797

The callstack at the point of the crash is:

stack: strlen :: lib/gstr.c:34 <-
        _asn1_str_cat :: lib/parser_aux.c:797 <-
        _asn1_expand_object_id :: ASN1.y:704 <-
        asn1_parser2tree :: src/asn1Decoding.c:155 <-
        main

The commandline to reproduce is:

src/asn1Decoding null_string.asn null_string.asn PKIX1.Certificate

Attachment: null_string.asn
Description: null_string.asn

Attachment: ATT00001.txt
Description: ATT00001.txt


reply via email to

[Prev in Thread] Current Thread [Next in Thread]