Hello,
my colleague Jan Hofmann experimented with new ASN.1 code from
openssl-0.9.7-beta4. He achieved buggy behavior when parsing
incomplete (truncated) DER data under specific conditions.
Openssl does'not detect any error while parsing truncated DER data.
He asked on openssl-users mailling list without response.
I tried to debug his code down into libcrypto and localized bug
in function asn1_d2i_read_bio().
I found this problem in RT/openssl.org since May 2002 (Id #20).
NOTE: Rsync protocol on dev.openssl.org is down now, so I can't
view the latest crypto/asn1/a_d2i_fp.c (update local CVS mirror).
There is the last and only mail in RT:
> [[EMAIL PROTECTED] - Sat May 4 20:44:23 2002]:
>
> > Experimenting with "openssl smime -decrypt", I found that it did not
> > detect that a
> > message was truncated. Changing line 173 of crypto/asn1/a_d2i_fp.c
> > from
> > if (i <= 0)
> > to
> > if (i < want)
> > fixes the problem. I think this is the right code for all cases, but
> > somebody who
> > actually understands the whole ASN parsing framework should probably
> > check it out.
> >
>
> Its a bit more complex than that. The reason for the <=0 test is because
> the actual value for 'want' is not always accurate. In particular when a
> header is being read 'want' is set to HEADER_SIZE which is 8.
>
> This is a only upper bound for a sensible header size. A valid header
> may only be two octets in length: 0x30, 0x0 for example is a zero
> length SEQUENCE.
>
> So what is actually needed is two different techniques, one to read
> in the header and the other the content octets (assuming their
> size is accurately known).
>
> Steve.
My try to solve problem is attached. I added variable 'require'
parallel to 'want'...
I have written this patch only on facts mentioned in Steve's
mail. I have not analysed code deeply. Review is needed.
I would be pleased, if you would be so kind and have look at this
serious bug. Thank you very much.
--
Zito
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
