security fix from http://www.openssl.org/news/secadv_20030930.txt

see also http://cvs.openssl.org/chngview?cn=11471

1 files changed, 2 insertions, 0 deletions

diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 60f36bb958..aed2895400 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -104,10 +104,12 @@ int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
                         l<<=7L;
                         l|= *(p++)&0x7f;
                         if (--max == 0) goto err;
+                        if (l > (INT_MAX >> 7L)) goto err;
                         }
                 l<<=7L;
                 l|= *(p++)&0x7f;
                 tag=(int)l;
+                if (--max == 0) goto err;
                 }
         else
                 {