Merge pull request #702 from terrafrost/asn1-fix-2.0

ASN1 parsing fix for issue mainly effecting CSR's for 2.0 branch

* terrafrost/asn1-fix-2.0:
  Tests/X509: PHP5 adjustments
  ASN1: handle malformed input better
  Tests/X509/CSR: add unit test for ASN1 changes
  ASN1: constructed context-specific tags can have x sub elements

phpseclib/File/ASN1.php

@@ -268,6 +268,10 @@ class ASN1
             $current+= array('headerlength' => 2);
         }
 
+        if ($length > strlen($encoded)) {
+            return false;
+        }
+
         $content = $this->_string_shift($encoded, $length);
 
         // at this point $length can be overwritten. it's only accurate for definite length things as is
@@ -296,14 +300,21 @@ class ASN1
                 }
 
                 $newcontent = array();
-                if (strlen($content)) {
-                    $newcontent = $this->_decode_ber($content, $start);
-                    $length = $newcontent['length'];
+                $remainingLength = $length;
+                while ($remainingLength > 0) {
+                    $temp = $this->_decode_ber($content, $start);
+                    $length = $temp['length'];
+                    // end-of-content octets - see paragraph 8.1.5
                     if (substr($content, $length, 2) == "\0\0") {
                         $length+= 2;
+                        $start+= $length;
+                        $newcontent[] = $temp;
+                        break;
                     }
                     $start+= $length;
-                    $newcontent = array($newcontent);
+                    $remainingLength-= $length;
+                    $newcontent[] = $temp;
+                    $this->_string_shift($content, $length);
                 }
 
                 return array(

tests/Unit/File/X509/CSRTest.php

@@ -28,4 +28,44 @@ v5RwaQHmQEzHofTzF7I+
 
         $this->assertInternalType('array', $spkac);
     }
+
+    public function testCSRWithAttributes()
+    {
+        $test = '-----BEGIN NEW CERTIFICATE REQUEST-----
+MIIFGDCCAwACAQAwOjEWMBQGCgmSJomT8ixkARkWBnNlY3VyZTEgMB4GA1UEAxMX
+LlNlY3VyZSBFbnRlcnByaXNlIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQCzgEpL+Za7a3y7YpURDrxlGIBlks25fD0tHaZIYkBTaXA5h+9MWoXn
+FA7AlIUt8pbBvXdJbOCmGaeQmBfBH0Qy9vTbx/DR2IOwzqy2ZHuurI5bPL12ceE2
+Mxa9xgY/i7U6MAUtoA3amEd7cKj2fz9EWZruRladOX0DXv9KexSan+45QjCWH+u2
+Cxem2zH9ZDNPGBuAF9YsAvkdHdAoX8aSm05ZAjUiO2e/+L57whh7zZiDY3WIhin7
+N/2JNTKVO6lx50S8a34XUKBt3SKgSR941hcLrBYUNftUYsTPo40bzKKcWqemiH+w
+jQiDrln4V2b5EbVeoGWe4UDPXCVmC6UPklG7iYfF0eeK4ujV8uc9PtV2LvGLOFdm
+AYE3+FAba5byQATw/DY8EJKQ7ptPigJhVe47NNeJlsKwk1haJ9k8ZazjS+vT45B5
+pqe0yBFAEon8TFnOLnAOblmKO12i0zqMUNAAlmr1c8jNjLr+dhruS+QropZmzZ24
+mAnFG+Y0qpfhMzAxTGQyVjyGwDfRK/ARmtrGpmROjj5+6VuMmZ6Ljf3xN09epmtH
+gJe+lYNBlpfUYg16tm+OusnziYnXL6nIo2ChOY/7GNJJif9fjvvaPDCC98K64av5
+5rpIx7N/XH4hwHeQQkEQangExE+8UMyBNFNmvPnIHVHUZdYo4SLsYwIDAQABoIGY
+MBsGCisGAQQBgjcNAgMxDRYLNi4zLjk2MDAuMi4weQYJKoZIhvcNAQkOMWwwajAQ
+BgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQU5nEIMEUT5mMd1WepmviwgK7dIzww
+GQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB
+/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAKZl6bAeaID3b/ic4aztL8ZZI7vi
+D3A9otUKx6v1Xe63zDPR+DiWSnxb9m+l8OPtnWkcLkzEIM/IMWorHKUAJ/J871D0
+Qx+0/HbkcrjMtVu/dNrtb9Z9CXup66ZvxTPcpEziq0/n2yw8QdBaa+lli65Qcwcy
+tzMQK6WQTRYfvVCIX9AKcPKxwx1DLH+7hL/bERB1lUDu59Jx6fQfqJrFVOY2N8c0
+MGvurfoHGmEoyCMIyvmIMu4+/wSNEE/sSDp4lZ6zuF6rf1m0GiLdTX2XJE+gfvep
+JTFmp4S3WFqkszKvaxBIT+jV0XKTNDwnO+dpExwU4jZUh18CdEFkIUuQb0gFF8B7
+WJFVpNdsRqZRPBz83BW1Kjo0yAmaoTrGNmG0p6Qf3K2zbk1+Jik3VZq4rvKoTi20
+6RvLA2//cMNfkYPsuqvoHGe2e0GOLtIB63wJzloWROpb72ohEHsvCKullIJVSuiS
+9sfTBAenHCyndgAEd4T3npTUdaiNumVEm5ilZId7LAYekJhkgFu3vlcl8blBJKjE
+skVTp7JpBmdXCL/G/6H2SFjca4JMOAy3DxwlGdgneIaXazHs5nBK/BgKPIyPzZ4w
+secxBTTCNgI48YezK3GDkn65cmlnkt6F6Mf0MwoDaXTuB88Jycbwb5ihKnHEJIsO
+draiRBZruwMPwPIP
+-----END NEW CERTIFICATE REQUEST-----';
+
+        $x509 = new X509();
+
+        $csr = $x509->loadCSR($test);
+
+        $this->assertInternalType('array', $csr);
+    }
 }