@@ -41719,7 +41719,6 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
4171941719 word32* inOutIdx, word32 sz)
4172041720{
4172141721 int length;
41722- int needed;
4172341722 word32 idx;
4172441723 word32 ext_bound; /* boundary index for the sequence of extensions */
4172541724 word32 oid;
@@ -41804,7 +41803,7 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
4180441803 WOLFSSL_MSG("\tcouldn't parse CRL number extension");
4180541804 return ret;
4180641805 }
41807- else {
41806+ else if (length <= CRL_MAX_NUM_SZ) {
4180841807 DECL_MP_INT_SIZE_DYN(m, CRL_MAX_NUM_SZ_BITS,
4180941808 CRL_MAX_NUM_SZ_BITS);
4181041809 NEW_MP_INT_SIZE(m, CRL_MAX_NUM_SZ_BITS, NULL,
@@ -41825,15 +41824,7 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
4182541824
4182641825 if (ret != MP_OKAY)
4182741826 ret = BUFFER_E;
41828- /* Check CRL number size
41829- * if it exceeds CRL_MAX_NUM_SZ(octets)
41830- * and CRL_MAX_NUM_HEX_STR_SZ(hex string)
41831- */
41832- if (((needed = mp_unsigned_bin_size(m)) > CRL_MAX_NUM_SZ) ||
41833- ((needed * 2 + 1) > CRL_MAX_NUM_HEX_STR_SZ)) {
41834- WOLFSSL_MSG("CRL number exceeds limitation.");
41835- ret = BUFFER_E;
41836- }
41827+
4183741828 if (ret == MP_OKAY && mp_toradix(m, (char*)dcrl->crlNumber,
4183841829 MP_RADIX_HEX) != MP_OKAY)
4183941830 ret = BUFFER_E;
@@ -41846,6 +41837,9 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
4184641837
4184741838 if (ret != MP_OKAY)
4184841839 return ret;
41840+ } else {
41841+ WOLFSSL_MSG("CRL number exceeds limitation");
41842+ ret = BUFFER_E;
4184941843 }
4185041844 }
4185141845 }
@@ -41871,7 +41865,6 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf, word32 idx,
4187141865 word32 maxIdx)
4187241866{
4187341867 DECL_ASNGETDATA(dataASN, certExtASN_Length);
41874- int needed;
4187541868 int ret = 0;
4187641869 /* Track if we've seen these extensions already */
4187741870 word32 seenAuthKey = 0;
@@ -41949,16 +41942,16 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf, word32 idx,
4194941942 }
4195041943
4195141944 if (ret == 0) {
41952- ret = GetInt(m, buf, &localIdx, maxIdx) ;
41953- }
41954- /* Check CRL number size
41955- * if it exceeds CRL_MAX_NUM_SZ(octets)
41956- * and CRL_MAX_NUM_HEX_STR_SZ(hex string)
41957- */
41958- if (((needed = mp_unsigned_bin_size(m)) > CRL_MAX_NUM_SZ) ||
41959- ((needed * 2 + 1) > CRL_MAX_NUM_HEX_STR_SZ) ) {
41960- WOLFSSL_MSG("CRL number exceeds limitation." );
41961- ret = BUFFER_E;
41945+ int crlNumLen = 0 ;
41946+ word32 tmpIdx = localIdx;
41947+ ret = GetASNInt(buf, &tmpIdx, &crlNumLen, maxIdx);
41948+ if (ret == 0 && (crlNumLen > CRL_MAX_NUM_SZ)) {
41949+ WOLFSSL_MSG("CRL number exceeds limitation");
41950+ ret = BUFFER_E;
41951+ }
41952+ if (ret == 0 ) {
41953+ ret = GetInt(m, buf, &localIdx, maxIdx );
41954+ }
4196241955 }
4196341956 if (ret == 0 && mp_toradix(m, (char*)dcrl->crlNumber,
4196441957 MP_RADIX_HEX) != MP_OKAY)
0 commit comments