xca icon indicating copy to clipboard operation
xca copied to clipboard

a1int::getLong() doesn't handle all error cases

Open melg8 opened this issue 2 years ago • 0 comments

In this method:

https://github.com/chris2511/xca/blob/3e858c877f1fc5f7d3286b6d6ed962ce0c53bced/lib/asn1int.cpp#L152-L157

openssl_error handles errors through ERR_get_error. So openssl should set error inside of method.

But implementation of function ASN1_INTEGER_get in openssl (in 1.1.1 and 3.0) have additional error case:

    if (r > LONG_MAX || r < LONG_MIN)
        return -1;

This error case is reported only by returning -1 value, and can't be detected through ERR_get_error mechanism.

So, in case of a1int containing value, larger/smaller than max/min value which can fit into long type - it will return -1 value, and this -1 value will be propagated as valid value inside of code using getLong() method.

melg8 avatar Apr 09 '22 20:04 melg8