From: Yusuke ENDOH <mame@...>
Date: 2011-01-26T18:48:12+09:00
Subject: [ruby-core:34868] Re: [Ruby 1.9-Bug#4324][Open] [ext/openssl] Parsing of incorrect ASN.1 values succeeds

Hi,

2011/1/26 Martin Bosslet <redmine@ruby-lang.org>:
> I read about this bug of OpenSSL this morning: http://rt.openssl.org/Ticket/Display.html?id=2438

Thank you for the information.
The URL seems to require authentification, but I managed to read it
by google:

http://rt.openssl.org/Ticket/Display.html?id=2438&user=guest&pass=guest


> What struck me was the following sentence:
>
> "The ASN1 parser should reject indefinite length primitive encodings as
> that is illegal."

I'm not sure that I understand the problem correctly.

ext/openssl (not openssl itself but Ruby binding) has its own ASN1
parser, and the parser does not follow the spec that openssl assumes
the users to follow, right?

-- 
Yusuke Endoh <mame@tsg.ne.jp>