From 2c913155a25171af571c0c3ee4b0cc2430bab667 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Wed, 6 Nov 2019 13:05:22 +0100
Subject: [PATCH] asn1: Do not accept non-minimal encoding of OBJECT IDs

---
 src/libopensc/asn1.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/libopensc/asn1.c b/src/libopensc/asn1.c
index 416d11e4..332a44a8 100644
--- a/src/libopensc/asn1.c
+++ b/src/libopensc/asn1.c
@@ -843,6 +843,12 @@ sc_asn1_decode_object_id(const u8 *inbuf, size_t inlen, struct sc_object_id *id)
 	while (inlen) {
 		if (!large_second_octet)
 			p++;
+		/* This signalizes empty most significant bits, which means
+		 * the unsigned integer encoding is not minimal */
+		if (*p == 0x80) {
+			sc_init_oid(id);
+			return SC_ERROR_INVALID_ASN1_OBJECT;
+		}
 		/* Use unsigned type here so we can process the whole INT range.
 		 * Values can not be negative */
 		a = *p & 0x7F;