From 6be326e7e7c73c472839bd446b42aa834dcbe5df Mon Sep 17 00:00:00 2001
From: terrafrost <terrafrost@gmail.com>
Date: Sat, 3 Apr 2021 12:04:07 -0500
Subject: [PATCH 1/2] Tests/ASN1: add test for OID garbage bytes

---
 tests/Unit/File/ASN1Test.php | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tests/Unit/File/ASN1Test.php b/tests/Unit/File/ASN1Test.php
index eda3ea36..84384b2c 100644
--- a/tests/Unit/File/ASN1Test.php
+++ b/tests/Unit/File/ASN1Test.php
@@ -405,4 +405,17 @@ class Unit_File_ASN1Test extends PhpseclibTestCase
         $decoded = $asn1->decodeBER($em);
         $this->assertFalse($decoded[0]);
     }
+
+    public function testOIDGarbage()
+    {
+        $asn1 = new File_ASN1();
+
+        $em = pack('H*', '3080305c065860864801650304020188888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888050004207509e5bda0c762d2bac7f90d758b5b2263fa01ccbc542ab5e3df163be08e6ca9');
+        $decoded = $asn1->decodeBER($em);
+        $this->assertFalse($decoded[0]);
+
+        $em = pack('H*', '3080307f067d608648016503040201888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888804207509e5bda0c762d2bac7f90d758b5b2263fa01ccbc542ab5e3df163be08e6ca9');
+        $decoded = $asn1->decodeBER($em);
+        $this->assertFalse($decoded[0]);
+    }
 }

From 8b8cbecb9b97f4b7aa60a45aea828e3c563b897d Mon Sep 17 00:00:00 2001
From: terrafrost <terrafrost@gmail.com>
Date: Sat, 3 Apr 2021 13:15:58 -0500
Subject: [PATCH 2/2] ASN1: make sure constructed bit is what it ought to be

---
 phpseclib/File/ASN1.php | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/phpseclib/File/ASN1.php b/phpseclib/File/ASN1.php
index a5369784..2424d341 100644
--- a/phpseclib/File/ASN1.php
+++ b/phpseclib/File/ASN1.php
@@ -433,13 +433,16 @@ class File_ASN1
         switch ($tag) {
             case FILE_ASN1_TYPE_BOOLEAN:
                 // "The contents octets shall consist of a single octet." -- paragraph 8.2.1
-                if (strlen($content) != 1) {
+                if ($constructed || strlen($content) != 1) {
                     return false;
                 }
                 $current['content'] = (bool) ord($content[$content_pos]);
                 break;
             case FILE_ASN1_TYPE_INTEGER:
             case FILE_ASN1_TYPE_ENUMERATED:
+                if ($constructed) {
+                    return false;
+                }
                 $current['content'] = new Math_BigInteger(substr($content, $content_pos), -256);
                 break;
             case FILE_ASN1_TYPE_REAL: // not currently supported
@@ -497,12 +500,15 @@ class File_ASN1
                 break;
             case FILE_ASN1_TYPE_NULL:
                 // "The contents octets shall not contain any octets." -- paragraph 8.8.2
-                if (strlen($content)) {
+                if ($constructed || strlen($content)) {
                     return false;
                 }
                 break;
             case FILE_ASN1_TYPE_SEQUENCE:
             case FILE_ASN1_TYPE_SET:
+                if (!$constructed) {
+                    return false;
+                }
                 $offset = 0;
                 $current['content'] = array();
                 $content_len = strlen($content);
@@ -523,6 +529,9 @@ class File_ASN1
                 }
                 break;
             case FILE_ASN1_TYPE_OBJECT_IDENTIFIER:
+                if ($constructed) {
+                    return false;
+                }
                 $current['content'] = $this->_decodeOID(substr($content, $content_pos));
                 if ($current['content'] === false) {
                     return false;
@@ -556,10 +565,16 @@ class File_ASN1
             case FILE_ASN1_TYPE_UTF8_STRING:
                 // ????
             case FILE_ASN1_TYPE_BMP_STRING:
+                if ($constructed) {
+                    return false;
+                }
                 $current['content'] = substr($content, $content_pos);
                 break;
             case FILE_ASN1_TYPE_UTC_TIME:
             case FILE_ASN1_TYPE_GENERALIZED_TIME:
+                if ($constructed) {
+                    return false;
+                }
                 $current['content'] = class_exists('DateTime') ?
                     $this->_decodeDateTime(substr($content, $content_pos), $tag) :
                     $this->_decodeUnixTime(substr($content, $content_pos), $tag);