catch case where blen%8 != 0

sjaeckel · sjaeckel · commit 40e4a666935f · 2017-10-01T22:56:47.000+02:00
diff --git a/src/pk/asn1/der/bit/der_decode_raw_bit_string.c b/src/pk/asn1/der/bit/der_decode_raw_bit_string.c
@@ -78,7 +78,7 @@ int der_decode_raw_bit_string(const unsigned char *in,  unsigned long inlen,
    blen = ((dlen - 1) << 3) - (in[x++] & 7);
 
    /* too many bits? */
-   if (blen/8 > *outlen) {
+   if ((blen + 7)/8 > *outlen) {
       *outlen = blen;
       return CRYPT_BUFFER_OVERFLOW;
    }

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@ int der_decode_raw_bit_string(const unsigned char *in, unsigned long inlen,`
`78`	`78`	`blen = ((dlen - 1) << 3) - (in[x++] & 7);`
`79`	`79`
`80`	`80`	`/* too many bits? */`
`81`		`- if (blen/8 > *outlen) {`
	`81`	`+ if ((blen + 7)/8 > *outlen) {`
`82`	`82`	`*outlen = blen;`
`83`	`83`	`return CRYPT_BUFFER_OVERFLOW;`
`84`	`84`	`}`