3 files changed, 33 insertions, 9 deletions

diff --git a/src/lib/libcrypto/asn1/a_enum.c b/src/lib/libcrypto/asn1/a_enum.c
index b0b851028a..b35fe43666 100644
--- a/src/lib/libcrypto/asn1/a_enum.c
+++ b/src/lib/libcrypto/asn1/a_enum.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_enum.c,v 1.26 2022/08/10 12:06:28 tb Exp $ */
+/* $OpenBSD: a_enum.c,v 1.27 2022/09/03 18:45:51 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -346,6 +346,28 @@ a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size)
 }
 
 int
+c2i_ASN1_ENUMERATED_cbs(ASN1_ENUMERATED **out_aenum, CBS *cbs)
+{
+        ASN1_ENUMERATED *aenum = NULL;
+
+        if (out_aenum == NULL)
+                return 0;
+
+        if (*out_aenum != NULL) {
+                ASN1_INTEGER_free(*out_aenum);
+                *out_aenum = NULL;
+        }
+
+        if (!c2i_ASN1_INTEGER_cbs((ASN1_INTEGER **)&aenum, cbs))
+                return 0;
+
+        aenum->type = V_ASN1_ENUMERATED | (aenum->type & V_ASN1_NEG);
+        *out_aenum = aenum;
+
+        return 1;
+}
+
+int
 i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a, unsigned char **out)
 {
         return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_ENUMERATED_it);
diff --git a/src/lib/libcrypto/asn1/asn1_locl.h b/src/lib/libcrypto/asn1/asn1_locl.h
index ec853250f2..e2c57fd8c4 100644
--- a/src/lib/libcrypto/asn1/asn1_locl.h
+++ b/src/lib/libcrypto/asn1/asn1_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_locl.h,v 1.35 2022/06/29 08:56:44 beck Exp $ */
+/* $OpenBSD: asn1_locl.h,v 1.36 2022/09/03 18:45:51 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -209,6 +209,8 @@ int asn1_tag2charwidth(int tag);
 int asn1_abs_set_unused_bits(ASN1_BIT_STRING *abs, uint8_t unused_bits);
 int c2i_ASN1_BIT_STRING_cbs(ASN1_BIT_STRING **out_abs, CBS *cbs);
 
+int c2i_ASN1_ENUMERATED_cbs(ASN1_ENUMERATED **out_aenum, CBS *cbs);
+
 int asn1_aint_get_uint64(CBS *cbs, uint64_t *out_val);
 int asn1_aint_set_uint64(uint64_t val, uint8_t **out_data, int *out_len);
 int asn1_aint_get_int64(CBS *cbs, int negative, int64_t *out_val);
diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c
index 235685484c..22d8006d0a 100644
--- a/src/lib/libcrypto/asn1/tasn_dec.c
+++ b/src/lib/libcrypto/asn1/tasn_dec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_dec.c,v 1.78 2022/06/29 08:56:44 beck Exp $ */
+/* $OpenBSD: tasn_dec.c,v 1.79 2022/09/03 18:45:51 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -277,7 +277,6 @@ static int
 asn1_c2i_primitive(ASN1_VALUE **pval, CBS *content, int utype, const ASN1_ITEM *it)
 {
         ASN1_STRING *stmp;
-        ASN1_INTEGER **tint;
         ASN1_BOOLEAN *tbool;
         uint8_t u8val;
         int ret = 0;
@@ -318,13 +317,14 @@ asn1_c2i_primitive(ASN1_VALUE **pval, CBS *content, int utype, const ASN1_ITEM *
                         goto err;
                 break;
 
-        case V_ASN1_INTEGER:
         case V_ASN1_ENUMERATED:
-                tint = (ASN1_INTEGER **)pval;
-                if (!c2i_ASN1_INTEGER_cbs(tint, content))
+                if (!c2i_ASN1_ENUMERATED_cbs((ASN1_ENUMERATED **)pval, content))
+                        goto err;
+                break;
+
+        case V_ASN1_INTEGER:
+                if (!c2i_ASN1_INTEGER_cbs((ASN1_INTEGER **)pval, content))
                         goto err;
-                /* Fixup type to match the expected form */
-                (*tint)->type = utype | ((*tint)->type & V_ASN1_NEG);
                 break;
 
         case V_ASN1_OCTET_STRING: