From 8070c6a4931801b6550c79c5766dfd3a99976036 Mon Sep 17 00:00:00 2001
From: Changqing Li <changqing.li@windriver.com>
Date: Thu, 8 Jul 2021 14:48:36 +0800
Subject: [PATCH] Merge pull request #15 from danaj/danaj/unsafe-decoding

Upstream-Status: Backport[https://github.com/gbarr/perl-Convert-ASN1/commit/108e784417db7893f348c381c837537c3bd39373]
CVE: CVE-2013-7488

Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
 lib/Convert/ASN1/_decode.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/Convert/ASN1/_decode.pm b/lib/Convert/ASN1/_decode.pm
index cd173f9..495e1bf 100644
--- a/lib/Convert/ASN1/_decode.pm
+++ b/lib/Convert/ASN1/_decode.pm
@@ -683,12 +683,14 @@ sub _scan_indef {
       $pos += 2;
       next;
     }
+    return if $pos >= $end;
 
     my $tag = substr($_[0], $pos++, 1);
 
     if((unpack("C",$tag) & 0x1f) == 0x1f) {
       my $b;
       do {
+        return if $pos >= $end;
 	$tag .= substr($_[0],$pos++,1);
 	$b = ord substr($tag,-1);
       } while($b & 0x80);
-- 
2.17.1

