Fixed Potential Integer Overflow in ASN1Reader::Next() Method (#19627)

project-chip · Nov 29, 2023 · 4759667 · 4759667
1 parent b7e7792
commit 4759667
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/lib/asn1/ASN1Reader.cpp b/src/lib/asn1/ASN1Reader.cpp
@@ -53,7 +53,9 @@ CHIP_ERROR ASN1Reader::Next()
  ReturnErrorCodeIf(EndOfContents, ASN1_END);
  ReturnErrorCodeIf(IndefiniteLen, ASN1_ERROR_UNSUPPORTED_ENCODING);
 
- mElemStart += (mHeadLen + ValueLen);
+ // Note: avoid using addition assignment operator (+=), which may result in integer overflow
+ // in the right hand side of an assignment (mHeadLen + ValueLen).
+ mElemStart = mElemStart + mHeadLen + ValueLen;
 
  ResetElementState();