From b3f95f64e8d46210990505a62f14434559bc7f62 Mon Sep 17 00:00:00 2001
From: Peter Dettman <peter.dettman@bouncycastle.org>
Date: Sun, 5 Apr 2020 18:39:00 +0700
Subject: Add guard in OID parsing

---
 crypto/src/bcpg/ECPublicBCPGKey.cs | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'crypto/src')

diff --git a/crypto/src/bcpg/ECPublicBCPGKey.cs b/crypto/src/bcpg/ECPublicBCPGKey.cs
index df19caac3..4733ee6c9 100644
--- a/crypto/src/bcpg/ECPublicBCPGKey.cs
+++ b/crypto/src/bcpg/ECPublicBCPGKey.cs
@@ -85,6 +85,8 @@ namespace Org.BouncyCastle.Bcpg
                 throw new EndOfStreamException();
             if (length == 0 || length == 0xFF)
                 throw new IOException("future extensions not yet implemented");
+            if (length > 127)
+                throw new IOException("unsupported OID");
 
             byte[] buffer = new byte[length + 2];
             bcpgIn.ReadFully(buffer, 2, buffer.Length - 2);
-- 
cgit 1.5.1