Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bug][数组越界]asn1模块中的tag掩码错误导致数组越界,且对应测试并没有测到这个bug #1751

Open
dihambo opened this issue Sep 27, 2024 · 0 comments

Comments

@dihambo
Copy link

dihambo commented Sep 27, 2024

// asn1.c
static const char *asn1_tag_index[] = {
	"[0]",  "[1]",  "[2]",  "[3]",  "[4]",  "[5]",  "[6]",  "[7]",  "[8]",  "[9]",
	"[10]", "[11]", "[12]", "[13]", "[14]", "[15]", "[16]", "[17]", "[18]", "[19]",
	"[20]", "[21]", "[22]", "[23]", "[24]", "[25]", "[26]", "[27]", "[28]", "[29]",
	"[30]", "[31]",
};

const char *asn1_tag_name(int tag)
{
	if (tag < 0 || tag > 0xff) {
		error_print();
		return NULL;
	}

	switch (tag & 0xc0) {
	case ASN1_TAG_CONTENT_SPECIFIC: return asn1_tag_index[tag & 0xe0];

tag & 0xe0明显是大于asn1_tag_index[]数组长度32的。这里的tag应该原本是想取后五位的值的。修改成tag|0x1f即可。

@dihambo dihambo changed the title [bug][数组越界]asn1模块中的tag逻辑错误导致数组越界,且对应测试并没有测到这个bug [bug][数组越界]asn1模块中的tag掩码错误导致数组越界,且对应测试并没有测到这个bug Sep 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant