MFC r350635: bsnmp: add asn1 message length validation

admbugs: 780 Submitted by: Guido Vranken, bz Reported by: Guido Vranken Approved by: so Security: CVE-2019-5610
HardenedBSD · Aug 6, 2019 · be804d7 · be804d7
1 parent af0383b
commit be804d7
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/contrib/bsnmp/lib/asn1.c b/contrib/bsnmp/lib/asn1.c
@@ -100,6 +100,11 @@ asn_get_header(struct asn_buf *b, u_char *type, asn_len_t *len)
 		*len = *b->asn_cptr++;
 		b->asn_len--;
 	}
+	if (*len > b->asn_len) {
+		asn_error(b, "len %u exceeding asn_len %u", *len, b->asn_len);
+		return (ASN_ERR_EOBUF);
+	}
+
 	return (ASN_ERR_OK);
 }