From 5a6ed90a00ea8b1070c808e4f7d5da173b2e848f Mon Sep 17 00:00:00 2001
From: Michael Brown <mcb30@ipxe.org>
Date: Fri, 11 Mar 2016 16:51:13 +0000
Subject: [PATCH] [crypto] Allow for zero-length ASN.1 cursors

The assumption in asn1_type() that an ASN.1 cursor will always contain
a type byte is incorrect.  A cursor that has been cleanly invalidated
via asn1_invalidate_cursor() will contain a type byte, but there are
other ways in which to arrive at a zero-length cursor.

Fix by explicitly checking the cursor length in asn1_type().  This
allows asn1_invalidate_cursor() to be reduced to simply zeroing the
length field.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/crypto/asn1.c       | 12 ------------
 src/include/ipxe/asn1.h | 16 ++++++++++++++--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/crypto/asn1.c b/src/crypto/asn1.c
index aca12bf30..9c71ffe10 100644
--- a/src/crypto/asn1.c
+++ b/src/crypto/asn1.c
@@ -81,18 +81,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #define EINFO_ENOTTY_ALGORITHM \
 	__einfo_uniqify ( EINFO_ENOTTY, 0x01, "Inappropriate algorithm" )
 
-/**
- * Invalidate ASN.1 object cursor
- *
- * @v cursor		ASN.1 object cursor
- */
-void asn1_invalidate_cursor ( struct asn1_cursor *cursor ) {
-	static uint8_t asn1_invalid_object[] = { ASN1_END, 0 };
-
-	cursor->data = asn1_invalid_object;
-	cursor->len = 0;
-}
-
 /**
  * Start parsing ASN.1 object
  *
diff --git a/src/include/ipxe/asn1.h b/src/include/ipxe/asn1.h
index 5fbd58281..2e635b48a 100644
--- a/src/include/ipxe/asn1.h
+++ b/src/include/ipxe/asn1.h
@@ -314,15 +314,27 @@ struct asn1_bit_string {
 	unsigned int unused;
 } __attribute__ (( packed ));
 
+/**
+ * Invalidate ASN.1 object cursor
+ *
+ * @v cursor		ASN.1 object cursor
+ */
+static inline __attribute__ (( always_inline )) void
+asn1_invalidate_cursor ( struct asn1_cursor *cursor ) {
+	cursor->len = 0;
+}
+
 /**
  * Extract ASN.1 type
  *
  * @v cursor		ASN.1 object cursor
- * @ret type		Type
+ * @ret type		Type, or ASN1_END if cursor is invalid
  */
 static inline __attribute__ (( always_inline )) unsigned int
 asn1_type ( const struct asn1_cursor *cursor ) {
-	return ( *( ( const uint8_t * ) cursor->data ) );
+	const uint8_t *type = cursor->data;
+
+	return ( ( cursor->len >= sizeof ( *type ) ) ? *type : ASN1_END );
 }
 
 extern void asn1_invalidate_cursor ( struct asn1_cursor *cursor );