commit 7c2edb917190c4f940c51918842203ff5ac7f7af
author Adam Langley <agl@google.com> Mon Feb 29 08:01:05 2016 -0800
committer Feng Yu <feny@google.com> Tue May 24 23:56:57 2016 +0000
tree 2f563fe617a1af6a4cc77be3d62ae7465ed54e62
parent e2e3a5ce71a2052acacda492e8b37b7646da7162

Fix encoding bug in i2c_ASN1_INTEGER

(Imported from upstream's 3661bb4e7934668bd99ca777ea8b30eedfafa871.)

Fix bug where i2c_ASN1_INTEGER mishandles zero if it is marked as
negative.

Thanks to Huzaifa Sidhpurwala <huzaifas@redhat.com> and Hanno Böck
<hanno@hboeck.de> for reporting this issue.

BUG=590615

(cherry-picked from c4eec0c16b02c97a62a95b6a08656c3a9ddb6baa)

Bug: 28175332
Change-Id: I8959e8ae01510a5924862a3f353be23130eee554
Reviewed-on: https://boringssl-review.googlesource.com/7199
Reviewed-by: David Benjamin <davidben@google.com>

src/crypto/asn1/a_int.c

diff --git a/src/crypto/asn1/a_int.c b/src/crypto/asn1/a_int.c
index 2ecccc5..16b8950 100644
--- a/src/crypto/asn1/a_int.c
+++ b/src/crypto/asn1/a_int.c
@@ -125,6 +125,8 @@
 		{
 		ret=a->length;
 		i=a->data[0];
+		if (ret == 1 && i == 0)
+			neg=0;
 		if (!neg && (i > 127)) {
 			pad=1;
 			pb=0;
@@ -158,7 +160,7 @@
 		p += a->length - 1;
 		i = a->length;
 		/* Copy zeros to destination as long as source is zero */
-		while(!*n) {
+		while(!*n && i > 1) {
 			*(p--) = 0;
 			n--;
 			i--;