commit 22c3b7b9dae1f5756635923d26f3df7f15e1d337
author Manuel Pégourié-Gonnard <mpg2@elzevir.fr> Wed Oct 21 12:07:47 2015 +0200
committer Manuel Pégourié-Gonnard <mpg2@elzevir.fr> Wed Oct 21 12:13:05 2015 +0200
tree 08349943252fa88d1bc43a960e9977fddda5411d
parent cdea97c1c310e6adfbcf92e5feb90f2841efde78

Fix potential buffer overflow in asn1write

library/asn1write.c

diff --git a/library/asn1write.c b/library/asn1write.c
index dd5a745..fd262a5 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -87,7 +87,7 @@
 {
     size_t len = 0;
 
-    if( *p - start < (int) size )
+    if( *p < start || (size_t)( *p - start ) < size )
         return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
 
     len = size;
@@ -107,7 +107,7 @@
     //
     len = mbedtls_mpi_size( X );
 
-    if( *p - start < (int) len )
+    if( *p < start || (size_t)( *p - start ) < len )
         return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
 
     (*p) -= len;
@@ -270,7 +270,7 @@
 
     // Calculate byte length
     //
-    if( *p - start < (int) size + 1 )
+    if( *p < start || (size_t)( *p - start ) < size + 1 )
         return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
 
     len = size + 1;