Struct corruption in der_decode_sequence_flexi.c

libtom / libtomcrypt

LibTomCrypt is a fairly comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines.

Other

1.51k stars 449 forks source link

Prerequisites

[x] Checked the developer manual
[x] Checked that your issue isn't already filed: https://github.com/issues?utf8=✓&q=repo%3Alibtom%2Flibtomcrypt
[x] Checked that your issue isn't due to the fact that you're using asymmetric cryptography and you forgot linking in and/or setting an MPI provider (usually this causes either random crashes or runtime errors like LTC_ARGCHK 'ltc_mp.name != NULL' failure ...). c.f. Ch. "Math Descriptors" of the developer manual.
[x] Checked that your issue isn't related to TomsFastMath's limitation that PK operations can by default only be done with max. 2048bit keys

Description

Inspecting der_decode_sequence_flexi.c at line 152, when parsing an INTEGER we have

             if ((err = mp_init(&l->data)) != CRYPT_OK) {
                 goto error;
             }

The function mp_init writes to an mp_int structure, but l->data is just a void*. This trashes the fields following data in the ltc_asn1_list struct.