120 lines
5.1 KiB
Diff
120 lines
5.1 KiB
Diff
diff -Nur bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/ASN1InputStream.java bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/ASN1InputStream.java
|
|
--- bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/ASN1InputStream.java 2019-12-25 16:41:28.246642457 +0800
|
|
+++ bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/ASN1InputStream.java 2019-12-25 16:42:45.727085573 +0800
|
|
@@ -139,7 +139,7 @@
|
|
{
|
|
boolean isConstructed = (tag & CONSTRUCTED) != 0;
|
|
|
|
- DefiniteLengthInputStream defIn = new DefiniteLengthInputStream(this, length);
|
|
+ DefiniteLengthInputStream defIn = new DefiniteLengthInputStream(this, length, limit);
|
|
|
|
if ((tag & APPLICATION) != 0)
|
|
{
|
|
diff -Nur bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/ASN1StreamParser.java bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/ASN1StreamParser.java
|
|
--- bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/ASN1StreamParser.java 2019-12-25 16:41:28.246642457 +0800
|
|
+++ bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/ASN1StreamParser.java 2019-12-25 16:43:14.097247799 +0800
|
|
@@ -168,7 +168,7 @@
|
|
}
|
|
else
|
|
{
|
|
- DefiniteLengthInputStream defIn = new DefiniteLengthInputStream(_in, length);
|
|
+ DefiniteLengthInputStream defIn = new DefiniteLengthInputStream(_in, length, _limit);
|
|
|
|
if ((tag & BERTags.APPLICATION) != 0)
|
|
{
|
|
diff -Nur bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/DefiniteLengthInputStream.java bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/DefiniteLengthInputStream.java
|
|
--- bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/DefiniteLengthInputStream.java 2019-12-25 16:41:28.246642457 +0800
|
|
+++ bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/DefiniteLengthInputStream.java 2019-12-25 16:45:17.287952074 +0800
|
|
@@ -19,9 +19,10 @@
|
|
|
|
DefiniteLengthInputStream(
|
|
InputStream in,
|
|
- int length)
|
|
+ int length,
|
|
+ int limit)
|
|
{
|
|
- super(in, length);
|
|
+ super(in, limit, length);
|
|
|
|
if (length < 0)
|
|
{
|
|
@@ -97,6 +98,12 @@
|
|
return EMPTY_BYTES;
|
|
}
|
|
|
|
+ //make sure it's safe to do this!
|
|
+ if (_remaining >= this.getLimit())
|
|
+ {
|
|
+ throw new IOException("corrupted stream - out of bounds length found: " + _remaining + " >= " + this.getLimit());
|
|
+ }
|
|
+
|
|
byte[] bytes = new byte[_remaining];
|
|
if ((_remaining -= Streams.readFully(_in, bytes)) != 0)
|
|
{
|
|
diff -Nur bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/IndefiniteLengthInputStream.java bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/IndefiniteLengthInputStream.java
|
|
--- bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/IndefiniteLengthInputStream.java 2019-12-25 16:41:28.246642457 +0800
|
|
+++ bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/IndefiniteLengthInputStream.java 2019-12-25 16:45:50.298140750 +0800
|
|
@@ -17,7 +17,7 @@
|
|
int limit)
|
|
throws IOException
|
|
{
|
|
- super(in, limit);
|
|
+ super(in, limit, limit);
|
|
|
|
_b1 = in.read();
|
|
_b2 = in.read();
|
|
diff -Nur bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/LimitedInputStream.java bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/LimitedInputStream.java
|
|
--- bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/LimitedInputStream.java 2019-12-25 16:41:28.256642514 +0800
|
|
+++ bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/LimitedInputStream.java 2019-12-25 16:47:41.218774610 +0800
|
|
@@ -10,19 +10,27 @@
|
|
{
|
|
protected final InputStream _in;
|
|
private int _limit;
|
|
+ private int _length;
|
|
|
|
LimitedInputStream(
|
|
InputStream in,
|
|
- int limit)
|
|
+ int limit,
|
|
+ int length)
|
|
{
|
|
this._in = in;
|
|
this._limit = limit;
|
|
+ this._length = length;
|
|
+ }
|
|
+
|
|
+ int getLimit()
|
|
+ {
|
|
+ return _limit;
|
|
}
|
|
|
|
int getRemaining()
|
|
{
|
|
// TODO: maybe one day this can become more accurate
|
|
- return _limit;
|
|
+ return _length;
|
|
}
|
|
|
|
protected void setParentEofDetect(boolean on)
|
|
diff -Nur bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/StreamUtil.java bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/StreamUtil.java
|
|
--- bc-java-r1rv61.org/core/src/main/java/org/bouncycastle/asn1/StreamUtil.java 2019-12-25 16:41:28.256642514 +0800
|
|
+++ bc-java-r1rv61/core/src/main/java/org/bouncycastle/asn1/StreamUtil.java 2019-12-25 16:48:49.509164763 +0800
|
|
@@ -11,7 +11,7 @@
|
|
private static final long MAX_MEMORY = Runtime.getRuntime().maxMemory();
|
|
|
|
/**
|
|
- * Find out possible longest length...
|
|
+ * Find out possible longest length, capped by available memory.
|
|
*
|
|
* @param in input stream of interest
|
|
* @return length calculation or MAX_VALUE.
|
|
@@ -20,7 +20,7 @@
|
|
{
|
|
if (in instanceof LimitedInputStream)
|
|
{
|
|
- return ((LimitedInputStream)in).getRemaining();
|
|
+ return ((LimitedInputStream)in).getLimit();
|
|
}
|
|
else if (in instanceof ASN1InputStream)
|
|
{
|