4 #include <asn_internal.h>
5 #include <ber_decoder.h>
6 #include <OCTET_STRING.h>
7 #include <ber_tlv_length.h>
8 #include <ber_tlv_tag.h>
15 write_to_buf(const void *buffer, size_t size, void *key) {
18 if(buf_off + size > buf_size) {
19 size_t n = buf_size?:16;
20 while(n < buf_off + size) n <<= 2;
21 buf = realloc(buf, n);
26 memcpy(buf + buf_off, buffer, size);
36 OCTET_STRING_t *nos = 0;
37 OCTET_STRING_t **nosp = &nos;
41 os = OCTET_STRING_new_fromBuf(&asn_DEF_OCTET_STRING, 0, size);
43 assert(os->size == 0);
45 os->buf = malloc(size);
49 for(size_t i = 0; i < size; i++) {
54 erval = der_encode(&asn_DEF_OCTET_STRING,
56 assert(erval.encoded >= 0 && (size_t)erval.encoded == buf_off);
57 assert(buf_off > size);
59 rval = ber_decode(0, &asn_DEF_OCTET_STRING, (void **)nosp, buf, buf_off);
60 assert(rval.code == RC_OK);
61 assert(rval.consumed == buf_off);
63 assert(os->size == nos->size);
65 for(size_t i = 0; i < size; i++) {
66 assert(os->buf[i] == nos->buf[i]);
70 fprintf(stderr, "new(%zd):", size);
71 for(size_t i = 0; i < (buf_off<10?buf_off:10); i++)
72 fprintf(stderr, " %02x", buf[i]);
77 ASN_STRUCT_FREE(asn_DEF_OCTET_STRING, os);
78 ASN_STRUCT_FREE(asn_DEF_OCTET_STRING, nos);
83 uint8_t buf1[] = {0x85, 0x00, 0x01, 0x02, 0x03, 0x04};
84 uint8_t buf2[] = {0x85, 0x00, 0x7f, 0xff, 0x03, 0x04};
85 uint8_t buf3[] = {0x85, 0x00, 0x7f, 0xff, 0xff, 0x04};
86 uint8_t buf4[] = {0x89, 0x00, 0x7f, 0xff, 0xff,
87 0xff, 0xff, 0xff, 0xff, 0x04};
88 ber_tlv_len_t tlv_len;
91 for(size_t i = 0; i < 66000; i++) {
92 if(i == 4500) i = 64000; /* Jump */
96 ret = ber_fetch_length(0, buf1, sizeof(buf1), &tlv_len);
97 printf("ret=%zd, len=%zd\n", ret, tlv_len);
98 assert(ret == sizeof(buf1));
99 assert(tlv_len == 0x01020304);
102 * Here although tlv_len is not greater than 2^31,
103 * we ought to hit embedded length exploitation preventive checks.
105 ret = ber_fetch_length(0, buf2, sizeof(buf2), &tlv_len);
106 if(sizeof(tlv_len) <= 4) {
109 printf("ret=%zd, len=%zd\n", ret, tlv_len);
110 assert(ret == sizeof(buf2));
111 assert(tlv_len == 0x7fff0304);
114 if(sizeof(tlv_len) <= 4) {
115 ret = ber_fetch_length(0, buf3, sizeof(buf3), &tlv_len);
116 printf("ret=%zd\n", ret);
117 printf("len=0x%08zx\n", tlv_len);
120 if(sizeof(tlv_len) <= 8) {
121 ret = ber_fetch_length(0, buf4, sizeof(buf4), &tlv_len);
122 printf("ret=%zd\n", ret);