[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

limiting the ber decoder recursion

From: Nikos Mavrogiannopoulos
Subject: limiting the ber decoder recursion
Date: Thu, 4 Jan 2018 18:07:26 +0100

It seems that the BER decoder logic in _asn1_decode_simple_ber() uses
recursion to handle the indefinite string encoding. That is when the
length is not provided on the BER TLV encoding, and the decoder is
expected to go through a set of TLV pairs terminated by 0x00, 0x00.
That also means that the TLV pairs encapsulated within the indefinite
encoding, could employ indefinite encoding as well, requiring a
recursive handling of these cases.

However, that also means that a specially crafted structure, could
cause stack exhaustion on the BER decoder, leading the application to
crash. I have a patch set addressing that by introducing a limit of
3-levels of recursion, although that is a bit arbitrary. I have seen
on the wild encodings which involve 1-level of recursion, however,
I've never seen 2 or 3 levels for BER encodings. Are there any
concerns related to other implementations or structures produced by
other encoders?


reply via email to

[Prev in Thread] Current Thread [Next in Thread]