Tinic

An issue exists in the ` nx secure x509 asn1 tlv block parse()` function, which is used to parse ASN.1 TLV (tag-length-value) blocks from DER-encoded data during X.509 certificate parsing in TLS handshakes. The function reads a one-byte ASN.1 tag from the buffer before verifying if the buffer contains at least one byte. If the remaining length is zero, the function reads one byte past the end of the buffer before returning an error.

Two client-side TLS/DTLS handshake parsers contain bounded out-of-bounds reads. This occurs when the parsers read fields from a server-supplied message before validating if the message is long enough to contain them. The issue is triggered when a TLS or DTLS client connects to a malicious or malformed server; although a bounds check is present, it is executed after the read operation it is intended to protect.