Skip to content


Browse files Browse the repository at this point in the history
Don't set choice selector on parse failure.
Don't set choice selector on parse failure: this can pass unexpected
values to the choice callback. Instead free up partial structure


Thanks to Tyler Nighswander of ForAllSecure for reporting this issue.

Reviewed-by: Richard Levitte <>
  • Loading branch information
snhenson authored and mattcaswell committed Nov 10, 2016
1 parent 99d9784 commit 610b662
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions crypto/asn1/tasn_dec.c
Expand Up @@ -225,16 +225,14 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
/* If field not present, try the next one */
if (ret == -1)
* Set the choice selector here to ensure that the value is
* correctly freed upon error. It may be partially initialized
* even if parsing failed.
asn1_set_choice_selector(pval, i, it);
/* If positive return, read OK, break loop */
if (ret > 0)
/* Otherwise must be an ASN1 parsing error */
* Must be an ASN1 parsing error.
* Free up any partial choice value
asn1_template_free(pchptr, tt);
errtt = tt;
goto err;
Expand All @@ -252,6 +250,8 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
goto err;

asn1_set_choice_selector(pval, i, it);

if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))
goto auxerr;
*in = p;
Expand Down

0 comments on commit 610b662

Please sign in to comment.