commit 480416af9d4acb874d5f60bb725334f71103daf7
author Gilles Peskine <Gilles.Peskine@arm.com> Thu Jun 28 19:04:07 2018 +0200
committer itayzafrir <itay.zafrir@arm.com> Wed Sep 12 16:41:11 2018 +0300
tree 42af6c2394c39aad8a7d9d8c0c25fe5f1af2f682
parent 0c938be967f2cd05b0df36350811c824affbf9bb

Fix argument validation in asn1_write_10x

1 << bits doesn't work when bits is too large. Found by ASan.

tests/suites/test_suite_psa_crypto.function

diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function
index 0d1a25c..5f705e3 100644
--- a/tests/suites/test_suite_psa_crypto.function
+++ b/tests/suites/test_suite_psa_crypto.function
@@ -46,7 +46,9 @@
 {
     int ret;
     int len = bits / 8 + 1;
-    if( x >= 1 << bits )
+    if( bits == 0 )
+        return( MBEDTLS_ERR_ASN1_INVALID_DATA );
+    if( bits <= 8 && x >= 1 << ( bits - 1 ) )
         return( MBEDTLS_ERR_ASN1_INVALID_DATA );
     if( *p < start || *p - start < (ssize_t) len )
         return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );