laforge has submitted this change. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email )
Change subject: constr_CHOICE: fix always-true bounds check ......................................................................
constr_CHOICE: fix always-true bounds check
The guard around the td->elements[present - 1] access uses "present > 0 || present <= td->elements_count". Because every int satisfies at least one of the two clauses, the condition is always true, so a present index of 0 or one greater than elements_count indexes the elements array out of bounds (out of bounds read).
Use "&&" so the access is taken only when present is within [1, elements_count], matching the equivalent checks already used in CHOICE_constraint() and the print/compare helpers in this file.
Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf --- M src/constr_CHOICE.c 1 file changed, 1 insertion(+), 1 deletion(-)
Approvals: pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved Jenkins Builder: Verified
diff --git a/src/constr_CHOICE.c b/src/constr_CHOICE.c index df68feb..4397ad1 100644 --- a/src/constr_CHOICE.c +++ b/src/constr_CHOICE.c @@ -457,7 +457,7 @@ */ present = _fetch_present_idx(ptr, specs->pres_offset, specs->pres_size);
- if(present > 0 || present <= td->elements_count) { + if (present > 0 && present <= td->elements_count) { const asn_TYPE_member_t *elm = &td->elements[present-1]; const void *memb_ptr;