laforge submitted this change.

View Change

Approvals: pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved Jenkins Builder: Verified
constr_CHOICE: fix always-true bounds check

The guard around the td->elements[present - 1] access uses
"present > 0 || present <= td->elements_count". Because every int
satisfies at least one of the two clauses, the condition is always true,
so a present index of 0 or one greater than elements_count indexes the
elements array out of bounds (out of bounds read).

Use "&&" so the access is taken only when present is within
[1, elements_count], matching the equivalent checks already used in
CHOICE_constraint() and the print/compare helpers in this file.

Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf
---
M src/constr_CHOICE.c
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/constr_CHOICE.c b/src/constr_CHOICE.c
index df68feb..4397ad1 100644
--- a/src/constr_CHOICE.c
+++ b/src/constr_CHOICE.c
@@ -457,7 +457,7 @@
*/
present = _fetch_present_idx(ptr, specs->pres_offset, specs->pres_size);

- if(present > 0 || present <= td->elements_count) {
+ if (present > 0 && present <= td->elements_count) {
const asn_TYPE_member_t *elm = &td->elements[present-1];
const void *memb_ptr;


To view, visit change 42890. To unsubscribe, or for help writing mail filters, visit settings.

Gerrit-MessageType: merged
Gerrit-Project: libasn1c
Gerrit-Branch: master
Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf
Gerrit-Change-Number: 42890
Gerrit-PatchSet: 4
Gerrit-Owner: n0k0 <osmocom@hacky.software>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de>
Gerrit-Reviewer: laforge <laforge@osmocom.org>
Gerrit-Reviewer: pespin <pespin@sysmocom.de>
Gerrit-CC: lynxis lazus <lynxis@fe80.eu>