Merge branch '3.0'

phpseclib/File/ASN1.php

@@ -1136,6 +1136,11 @@ abstract class ASN1
         $oid = [];
         $pos = 0;
         $len = strlen($content);
+        // see https://github.com/openjdk/jdk/blob/2deb318c9f047ec5a4b160d66a4b52f93688ec42/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java#L55
+        if ($len > 4096) {
+            //throw new \RuntimeException("Object identifier size is limited to 4096 bytes ($len bytes present)");
+            return false;
+        }
 
         if (ord($content[$len - 1]) & 0x80) {
             return false;

phpseclib/Math/BigInteger/Engines/Engine.php

@@ -593,7 +593,7 @@ abstract class Engine implements \JsonSerializable
      */
     public function getLengthInBytes(): int
     {
-        return strlen($this->toBytes());
+        return (int) ceil($this->getLength() / 8);
     }
 
     /**

phpseclib/Math/BigInteger/Engines/PHP.php

@@ -1251,4 +1251,17 @@ abstract class PHP extends Engine
         }
         return false;
     }
+
+    /**
+     * Return the size of a BigInteger in bits
+     *
+     * @return int
+     */
+    public function getLength()
+    {
+        $max = count($this->value) - 1;
+        return $max != -1 ?
+            $max * static::BASE + intval(ceil(log($this->value[$max] + 1, 2))) :
+            0;
+    }
 }

tests/Unit/File/ASN1Test.php

@@ -452,4 +452,15 @@ class ASN1Test extends PhpseclibTestCase
         $decoded = ASN1::decodeBER($em);
         $this->assertNull($decoded);
     }
+
+    public function testLongOID()
+    {
+        $cert = file_get_contents(dirname(__FILE__) . '/ASN1/mal-cert-02.der');
+
+        $decoded = ASN1::decodeBER($cert);
+        $this->assertNull($decoded);
+
+        //$x509 = new X509();
+        //$x509->loadX509($cert);
+    }
 }