BACKPORT: asn1_find_node: added safety check on asn1_find_node()

This prevents a stack overflow in asn1_find_node() which
is triggered by too long variable names in the definitions
files. That means that applications have to deliberately
pass a too long 'name' constant to asn1_write_value()
and friends.  Reported by Jakub Jirasek.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
Signed-off-by: Rafal Krypa <r.krypa@samsung.com>
(cherry-picked from upstream 5520704d075802df25ce4ffccc010ba1641bd484)

Change-Id: I893834c68ede90cd5953289a2c207c79e2971b51

diff --git a/lib/parser_aux.c b/lib/parser_aux.c
index 52700c6..16379af 100644 (file)
--- a/lib/parser_aux.c
+++ b/lib/parser_aux.c
@@ -120,6 +120,9 @@ asn1_find_node (asn1_node pointer, const char *name)
       if (n_end)
        {
          nsize = n_end - n_start;
+         if (nsize >= sizeof(n))
+               return NULL;
+
          memcpy (n, n_start, nsize);
          n[nsize] = 0;
          n_start = n_end;
@@ -158,6 +161,9 @@ asn1_find_node (asn1_node pointer, const char *name)
       if (n_end)
        {
          nsize = n_end - n_start;
+         if (nsize >= sizeof(n))
+               return NULL;
+
          memcpy (n, n_start, nsize);
          n[nsize] = 0;
          n_start = n_end;