-
Notifications
You must be signed in to change notification settings - Fork 716
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SIGSEGV in sc_asn1_read_tag when parsing malformed ASN.1 data #190
Comments
I also thing this code is suspect and dangerous. The best way to fix this is to understand where/when this special case is used in OpeSC. But this would involve using many different cards with many different ASN.1 encoded data. Not easy. |
ASN.1 formatted data that is padded with '0x00' to fill a fixed size file is very common on smart cards. Would sc_asn1_read_tag still ignore the junk at the end or would it rather throw an error (which would be wrong)? |
On 10/1/2014 4:05 PM, Frank Morgner wrote:
https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf defines an "End of Content" for BER. 8.1.5 End-of-contents octets A Layman's Guide to a Subset of ASN.1, BER, and DER https://luca.ntop.org/Teaching/Appunti/asn1.html 3.3 Constructed, indefinite-length method Most of the ASN.1 we use is DER. Does the length of the top most ASN.1 include the length of padding? Or is the padding after the last of the ASN.1 bytes to fill the buffer? This could OK, as the padding is not part of the ASN.1
Douglas E. Engert [email protected] |
It would be safe to do the following:
Could you provide a patch? |
The issue is on this line:
https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/asn1.c#L68
When passing in an object starting with 00 or FF the function returns SC_SUCCESS with an uninitialized tag_out and taglen.
Most caller like pgp_enumerate_blob will call the function again after adding the uninitialized length to the pointer resulting in a SIGSEGV.
I can see three ways to fix it (I'd prefer the first one):
A) Don't treat 00 or FF as special tag values (I don't see why they should be by reading ITU X.690 but I might have missed something).
B) Return an error instead of SC_SUCCESS
C) Set tag_out = 0, tag_len = 0 and modify all callers so they don't enter an infinite loop in that situation (least favored fix).
What is the best way to fix it? Send you a patch?
The text was updated successfully, but these errors were encountered: