Fix Potential ASN1 Buffer Overflows in EnterContainer() and DecodeHea…

…d() (#19549)
project-chip · Jun 14, 2022 · 9493d7b · 9493d7b
1 parent 075dd3e
commit 9493d7b
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/lib/asn1/ASN1Reader.cpp b/src/lib/asn1/ASN1Reader.cpp
@@ -1,6 +1,6 @@
 /*
  *
- * Copyright (c) 2020-2021 Project CHIP Authors
+ * Copyright (c) 2020-2022 Project CHIP Authors
  * Copyright (c) 2013-2017 Nest Labs, Inc.
  * All rights reserved.
  *
@@ -113,6 +113,8 @@ CHIP_ERROR ASN1Reader::EnterContainer(uint32_t offset)
  mElemStart = Value + offset;
  if (!IndefiniteLen)
  {
+ VerifyOrReturnError(CanCastTo<uint32_t>(mBufEnd - Value), ASN1_ERROR_VALUE_OVERFLOW);
+ VerifyOrReturnError(static_cast<uint32_t>(mBufEnd - Value) >= ValueLen, ASN1_ERROR_VALUE_OVERFLOW);
  mContainerEnd = Value + ValueLen;
  }
 
@@ -303,8 +305,9 @@ CHIP_ERROR ASN1Reader::DecodeHead()
  IndefiniteLen = false;
  }
 
+ VerifyOrReturnError(CanCastTo<uint32_t>(mBufEnd - p), ASN1_ERROR_VALUE_OVERFLOW);
+ VerifyOrReturnError(static_cast<uint32_t>(mBufEnd - p) >= ValueLen, ASN1_ERROR_VALUE_OVERFLOW);
  VerifyOrReturnError(CanCastTo<uint32_t>(p - mElemStart), ASN1_ERROR_VALUE_OVERFLOW);
-
  mHeadLen = static_cast<uint32_t>(p - mElemStart);
 
  EndOfContents = (Class == kASN1TagClass_Universal && Tag == 0 && !Constructed && ValueLen == 0);