tls: DER length byte 0x81 is actually valid

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 16 insertions, 11 deletions

diff --git a/networking/tls.c b/networking/tls.c
index 3b6347ecc..69c81b558 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -348,7 +348,7 @@ static void get_server_hello_or_die(tls_state_t *tls)
 
 static unsigned get_der_len(uint8_t **bodyp, uint8_t *der, uint8_t *end)
 {
-	unsigned len;
+	unsigned len, len1;
 
 	if (end - der < 2)
 		xfunc_die();
@@ -358,24 +358,29 @@ static unsigned get_der_len(uint8_t **bodyp, uint8_t *der, uint8_t *end)
 	len = der[1]; /* maybe it's short len */
 	if (len >= 0x80) {
 		/* no */
-		if (len != 0x82) {
+		if (end - der < (int)(len - 0x7e)) /* need 3 or 4 bytes for 81, 82 */
+			xfunc_die();
+
+		len1 = der[2];
+		if (len == 0x81) {
+			/* it's "ii 81 xx" */
+		} else if (len == 0x82) {
+			/* it's "ii 82 xx yy" */
+			len1 = 0x100*len1 + der[3];
+			der += 1; /* skip [yy] */
+		} else {
 			/* 0x80 is "0 bytes of len", invalid DER: must use short len if can */
-			/* 0x81 is "1 byte of len", invalid DER */
 			/* >0x82 is "3+ bytes of len", should not happen realistically */
 			xfunc_die();
 		}
-		if (end - der < 4)
-			xfunc_die();
-		/* it's "ii 82 xx yy" */
-		len = 0x100*der[2] + der[3];
+		der += 1; /* skip [xx] */
+		len = len1;
 //		if (len < 0x80)
 //			xfunc_die(); /* invalid DER: must use short len if can */
-
-		der += 2; /* skip [code]+[82]+[2byte_len] */
 	}
-	der += 2; /* skip [code]+[1byte_len] */
+	der += 2; /* skip [code]+[1byte] */
 
-	if (end - der < len)
+	if (end - der < (int)len)
 		xfunc_die();
 	*bodyp = der;