fix bit-length check in der_decode_raw_bit_string()

sjaeckel · sjaeckel · commit 0b0427989025 · 2017-10-01T22:56:46.000+02:00
diff --git a/src/pk/asn1/der/bit/der_decode_raw_bit_string.c b/src/pk/asn1/der/bit/der_decode_raw_bit_string.c
@@ -77,7 +77,7 @@ int der_decode_raw_bit_string(const unsigned char *in,  unsigned long inlen,
    blen = ((dlen - 1) << 3) - (in[x++] & 7);
 
    /* too many bits? */
-   if (blen > *outlen) {
+   if (blen/8 > *outlen) {
       *outlen = blen;
       return CRYPT_BUFFER_OVERFLOW;
    }

Original file line number	Diff line number	Diff line change
`@@ -77,7 +77,7 @@ int der_decode_raw_bit_string(const unsigned char *in, unsigned long inlen,`
`77`	`77`	`blen = ((dlen - 1) << 3) - (in[x++] & 7);`
`78`	`78`
`79`	`79`	`/* too many bits? */`
`80`		`- if (blen > *outlen) {`
	`80`	`+ if (blen/8 > *outlen) {`
`81`	`81`	`*outlen = blen;`
`82`	`82`	`return CRYPT_BUFFER_OVERFLOW;`
`83`	`83`	`}`