ASN1 Buffer Overflow

[robszewczyk]

Problem

The ASN1Reader class has to keep track of the parsing state, and in one location it is
possible to cause the reader to access data outside the bounds of the buffer being read.
This occurs in the code excerpt below when the end of the container is set to a point that
might be beyond the end of the buffer containing the parsed data.

In ASN1Reader::EnterContainer, we find:

    CHIP_ERROR ASN1Reader::EnterContainer(uint32_t offset)
    {
        ReturnErrorCodeIf(mNumSavedContexts == kMaxContextDepth, ASN1_ERROR_MAX_DEPTH_EXCEEDED);
        mSavedContexts[mNumSavedContexts].ElemStart = mElemStart;
        mSavedContexts[mNumSavedContexts].HeadLen = mHeadLen;
        mSavedContexts[mNumSavedContexts].ValueLen = ValueLen;
        mSavedContexts[mNumSavedContexts].IndefiniteLen = IndefiniteLen;
        mSavedContexts[mNumSavedContexts].ContainerEnd = mContainerEnd;
        mNumSavedContexts++;
        mElemStart = Value + offset;
        if (!IndefiniteLen)
        {
            mContainerEnd = Value + ValueLen;
        }
        ResetElementState();
        return CHIP_NO_ERROR;
    }

If Value + ValueLen runs beyond mContainerEnd , a future access might be outside the bounds of
the buffer, as other locations within the code assume that mContainerEnd falls within the
bounds of the buffer passed to the Init function. This issue resulted in various out of
bounds read accesses throughout the reader, depending on the type being read.

[emargolis]

Fixed with #19549. Closing