1 files changed, 21 insertions, 1 deletions
diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c
index 70dc355ca1..9e6ceacd4a 100644
--- a/src/lib/libcrypto/asn1/tasn_dec.c
+++ b/src/lib/libcrypto/asn1/tasn_dec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_dec.c,v 1.37 2019/04/01 15:48:04 jsing Exp $ */
+/* $OpenBSD: tasn_dec.c,v 1.37.6.1 2020/12/08 15:10:03 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 2000.
 */
@@ -210,6 +210,16 @@ asn1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
                break;
        case ASN1_ITYPE_MSTRING:
+                /*
+                 * It never makes sense for multi-strings to have implicit
+                 * tagging, so if tag != -1, then this looks like an error in
+                 * the template.
+                 */
+                if (tag != -1) {
+                        ASN1error(ASN1_R_BAD_TEMPLATE);
+                        goto err;
+                }
                p = *in;
                /* Just read in tag and class */
                ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
@@ -245,6 +255,16 @@ asn1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
                    it, tag, aclass, opt, ctx);
        case ASN1_ITYPE_CHOICE:
+                /*
+                 * It never makes sense for CHOICE types to have implicit
+                 * tagging, so if tag != -1, then this looks like an error in
+                 * the template.
+                 */
+                if (tag != -1) {
+                        ASN1error(ASN1_R_BAD_TEMPLATE);
+                        goto err;
+                }
                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
                        goto auxerr;

diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c index 70dc355ca1..9e6ceacd4a 100644 --- a/src/lib/libcrypto/asn1/tasn_dec.c +++ b/src/lib/libcrypto/asn1/tasn_dec.c
@@ -1,4 +1,4 @@
1	/* $OpenBSD: tasn_dec.c,v 1.37 2019/04/01 15:48:04 jsing Exp $ */	1	/* $OpenBSD: tasn_dec.c,v 1.37.6.1 2020/12/08 15:10:03 tb Exp $ */
2	/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL	2	/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3	* project 2000.	3	* project 2000.
4	*/	4	*/
@@ -210,6 +210,16 @@ asn1_item_ex_d2i(ASN1_VALUE pval, const unsigned char in, long len,
210	break;	210	break;
211		211
212	case ASN1_ITYPE_MSTRING:	212	case ASN1_ITYPE_MSTRING:
		213	/*
		214	* It never makes sense for multi-strings to have implicit
		215	* tagging, so if tag != -1, then this looks like an error in
		216	* the template.
		217	*/
		218	if (tag != -1) {
		219	ASN1error(ASN1_R_BAD_TEMPLATE);
		220	goto err;
		221	}
		222
213	p = *in;	223	p = *in;
214	/* Just read in tag and class */	224	/* Just read in tag and class */
215	ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,	225	ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
@@ -245,6 +255,16 @@ asn1_item_ex_d2i(ASN1_VALUE pval, const unsigned char in, long len,
245	it, tag, aclass, opt, ctx);	255	it, tag, aclass, opt, ctx);
246		256
247	case ASN1_ITYPE_CHOICE:	257	case ASN1_ITYPE_CHOICE:
		258	/*
		259	* It never makes sense for CHOICE types to have implicit
		260	* tagging, so if tag != -1, then this looks like an error in
		261	* the template.
		262	*/
		263	if (tag != -1) {
		264	ASN1error(ASN1_R_BAD_TEMPLATE);
		265	goto err;
		266	}
		267
248	if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))	268	if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
249	goto auxerr;	269	goto auxerr;
250		270