tree 7fa97099f07453b07c09d44ee2cf848b9fce2e6d
parent 7a61b951fb94cbc644613850ca77f982baedf989
author Daniel Axtens <dja@axtens.net> 1626840030 +1000
committer Vasant Hegde <hegdevasant@linux.vnet.ibm.com> 1626933824 +0530

pkcs7: pkcs7_get_content_info_type should reset *p on error

[ Upstream commit d8e13853e506e00713d15fa5e23457ba21a16829 ]

Fuzzing revealed a crash where pkcs7_get_signed_data was accessing beyond
the bounds of the object, despite valid data being passed in to
mbedtls_pkcs7_parse_der.

Further investigation revealed that pkcs7_get_content_info_type will
reset *p to start if the second call to mbedtls_asn1_get_tag fails,
but not if the first call fails.

mbedtls_asn1_get_tag does indeed advance *p even in some failure
cases, so a reset is required.

Reset *p to start if the first call to mbedtls_asn1_get_tag fails.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Tested-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>