From: Jacob Fugal <lukfugl@...>
Date: 2006-04-27T14:19:22+09:00
Subject: Re: possible defect in ext/openssl/ossl_ans1.c (with fix)

On 4/26/06, ville.mattila@stonesoft.com <ville.mattila@stonesoft.com> wrote:
>
> I think this is false positive.

<snip>

>770                  if(!rb_obj_is_kind_of(value, rb_cArray)){

<snip>

> >778                    case V_ASN1_BIT_STRING:
> >779                        value = decode_bstr(start, hlen+len, &flag);
>       Here the flag is initialized

<snip>

> >800                  if(tag == V_ASN1_BIT_STRING){
>       and here we have same tag as in line 779.

But lines 778 and 779 are never executed if the condition in line 770
is false (ie. rb_obj_is_kind_of(value, rb_cArray) returns true). It's
possible that tag equalling V_ASN1_BIT_STRING and value being kind_of
rb_cArray are mutually exclusive. If so, the code is safe, but not
explicit. I would fix it by amending the conditional in line 800:

--- ext/openssl/ossl_asn1.c
+++ ext/openssl/ossl_asn1.c
@@ -797,7 +797,7 ****
               }
           }
           asn1data = rb_funcall(klass, rb_intern("new"), 1, value);
-          if(tag == V_ASN1_BIT_STRING){
+          if(!rb_obj_is_kind_of(value, rb_cArray) && tag == V_ASN1_BIT_STRING){
               rb_iv_set(asn1data, "@unused_bits", LONG2NUM(flag));
           }
       }

Jacob Fugal