Values greater than 255 can be written to a Buffer object position representing 1 byte

[stephenwvickers]

See: TritonDataCenter/node-asn1#6

@@ -233,14 +233,14 @@ Writer.prototype.writeLength = function(len) {
      this._buf[this._offset++] = len;
    } else if (len <= 0xffff) {
      this._buf[this._offset++] = 0x82;
 -    this._buf[this._offset++] = len >> 8;
 -    this._buf[this._offset++] = len;
 +    this._buf[this._offset++] = (len >> 8) & 0xff;
 +    this._buf[this._offset++] = len & 0xff;
    } else if (len <= 0xffffff) {
      this._shift(start, len, 1);
      this._buf[this._offset++] = 0x83;
 -    this._buf[this._offset++] = len >> 16;
 -    this._buf[this._offset++] = len >> 8;
 -    this._buf[this._offset++] = len;
 +    this._buf[this._offset++] = (len >> 16) & 0xff;
 +    this._buf[this._offset++] = (len >> 8) & 0xff;
 +    this._buf[this._offset++] = len & 0xff;
    } else {
      throw new InvalidAsn1ERror('Length too long (> 4 bytes)');
    }
 @@ -271,14 +271,14 @@ Writer.prototype.endSequence = function() {
      this._buf[seq + 1] = len;
    } else if (len <= 0xffff) {
      this._buf[seq] = 0x82;
 -    this._buf[seq + 1] = len >> 8;
 -    this._buf[seq + 2] = len;
 +    this._buf[seq + 1] = (len >> 8) & 0xff;
 +    this._buf[seq + 2] = len & 0xff;
    } else if (len <= 0xffffff) {
      this._shift(start, len, 1);
      this._buf[seq] = 0x83;
 -    this._buf[seq + 1] = len >> 16;
 -    this._buf[seq + 2] = len >> 8;
 -    this._buf[seq + 3] = len;
 +    this._buf[seq + 1] = (len >> 16) & 0xff;
 +    this._buf[seq + 2] = (len >> 8) & 0xff;
 +    this._buf[seq + 3] = len & 0xff;
    } else {
      throw new InvalidAsn1Error('Sequence too long');
    }

[stephenwvickers]

While I will assign this to the 1.0.0 milestone I will investigate and test before accepting it for release. If it doesn't merge correctly I will push back to the original requested and ask that they correct any issues before merging.

[stephenwvickers]

Original reporter: @husio-org

[stephenwvickers]

I have asked @husio-org via the original ticket to provide more details, since I can't see how this can happen in the current code.