228816 - SECU_StripTagAndLength does not verify length bytes

Status: NEW

(NSS :: Tools, defect, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

This bug was formerly comment 7 in bug 222568.  I am filing it here so that
bug 222568 can be resolved fixed.

In the new function SECU_StripTagAndLength, you just skip over the length
bytes, without calculating them to see if they match (or at least are not
greater than) the amount in i->len .

The code does perform the calculation of the length, but only in SECU_PrintSet.

I think that's not the right place to do it. It should be done and checked in
SECU_StripTagAndLength.

For the callers that want to have the value of the length bytes returned to
them (primarily the printset function), you could return the value in an
optional PRIn32* argument to SECU_StripTagAndLength (set to NULL if the caller
doesn't care about the length bytes).