From: GOTOU Yuuzou <gotoyuzo@...>
Date: 2006-04-28T21:01:32+09:00
Subject: Re: possible defect in ext/openssl/ossl_ans1.c (with fix)

Hi,

In message <E748A8BD-1DD2-40B4-9409-3CF8A3BF725E@waits.net>,
 `Stephen Waits <steve@waits.net>' wrote:
> On Apr 26, 2006, at 10:32 PM, ville.mattila@stonesoft.com wrote:
> >  You are correct. This seems like a right fix. We should have  
> > maintenar's
> > opinion as well.
> 
> Regardless, I'd just like to throw in that initialization is never a  
> bad idea.

Yes. I think flag should be initialized, but more checks are
unnecessary for now.

The ASN.1 data which has CONSTRUCTIVE bit and BIT_STRING tag
is abnormal. It causes abnormal output naturally :-)

% ruby -e '
require "openssl"
 
buf = String.new("\0" * 12)
buf[0] = OpenSSL::ASN1::BIT_STRING
buf[1] = 10  # length
buf[2] = 5   # unused bits
p OpenSSL::ASN1.decode(buf)

buf[0] |= 0b00100000    # set CONSTRUCTIVE
p OpenSSL::ASN1.decode(buf)
'
#<OpenSSL::ASN1::BitString:0x8103968 @tag=3, @tag_class=:UNIVERSAL, @value="\000\000\000\000\000\000\000\000\000", @tagging=nil, @unused_bits=5>
#<OpenSSL::ASN1::BitString:0x8103364 @tag=3, @tag_class=:UNIVERSAL, @value=[#<OpenSSL::ASN1::Null:0x810374c @tag=5, @tag_class=:UNIVERSAL, @value=nil, @tagging=nil>, #<OpenSSL::ASN1::ASN1Data:0x8103404 @tag=0, @tag_class=:UNIVERSAL, @value="">, #<OpenSSL::ASN1::ASN1Data:0x81033dc @tag=0, @tag_class=:UNIVERSAL, @value="">, #<OpenSSL::ASN1::ASN1Data:0x81033a0 @tag=0, @tag_class=:UNIVERSAL, @value="">, #<OpenSSL::ASN1::ASN1Data:0x8103378 @tag=0, @tag_class=:UNIVERSAL, @value="">], @tagging=nil, @unused_bits=135281120>

-- 
gotoyuzo