1 files changed, 26 insertions, 9 deletions

diff --git a/src/lib/libcrypto/asn1/a_object.c b/src/lib/libcrypto/asn1/a_object.c
index dc980421d0..e5fbe7cbb1 100644
--- a/src/lib/libcrypto/asn1/a_object.c
+++ b/src/lib/libcrypto/asn1/a_object.c
@@ -281,8 +281,6 @@ ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
         return ret;
 err:
         ASN1err(ASN1_F_D2I_ASN1_OBJECT,i);
-        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_OBJECT_free(ret);
         return(NULL);
 }
 ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
@@ -290,7 +288,19 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
         {
         ASN1_OBJECT *ret=NULL;
         const unsigned char *p;
+        unsigned char *data;
         int i;
+        /* Sanity check OID encoding: can't have leading 0x80 in
+         * subidentifiers, see: X.690 8.19.2
+         */
+        for (i = 0, p = *pp + 1; i < len - 1; i++, p++)
+                {
+                if (*p == 0x80 && (!i || !(p[-1] & 0x80)))
+                        {
+                        ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING);
+                        return NULL;
+                        }
+                }
 
         /* only the ASN1_OBJECTs from the 'table' will have values
          * for ->sn or ->ln */
@@ -302,15 +312,22 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
         else    ret=(*a);
 
         p= *pp;
-        if ((ret->data == NULL) || (ret->length < len))
+        /* detach data from object */
+        data = (unsigned char *)ret->data;
+        ret->data = NULL;
+        /* once detached we can change it */
+        if ((data == NULL) || (ret->length < len))
                 {
-                if (ret->data != NULL) OPENSSL_free(ret->data);
-                ret->data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
-                ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
-                if (ret->data == NULL)
+                ret->length=0;
+                if (data != NULL) OPENSSL_free(data);
+                data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
+                if (data == NULL)
                         { i=ERR_R_MALLOC_FAILURE; goto err; }
+                ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
                 }
-        memcpy(ret->data,p,(int)len);
+        memcpy(data,p,(int)len);
+        /* reattach data to object, after which it remains const */
+        ret->data  =data;
         ret->length=(int)len;
         ret->sn=NULL;
         ret->ln=NULL;
@@ -359,7 +376,7 @@ void ASN1_OBJECT_free(ASN1_OBJECT *a)
                 }
         if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA)
                 {
-                if (a->data != NULL) OPENSSL_free(a->data);
+                if (a->data != NULL) OPENSSL_free((void *)a->data);
                 a->data=NULL;
                 a->length=0;
                 }