# ASN.1 BIO excessive memory allocation (CVE-2016-2109)

ASN.1 BIO decoders in OpenSSL trusted the length field, so a 7-byte SEQUENCE header claiming 0x30303030 bytes forced huge memory allocation.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: geeknik
- Disclosed: 2016-05-03
- CVE: CVE-2016-2109
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/134880
- Library page: https://bugbountylibrary.com/r/h1%3A134880
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:linux technique:source-review vuln:dos vuln:memory-corruption

**Target:** ASN.1 BIO decoder (d2i_CMS_bio and similar)
**Root cause:** asn1_d2i_read_bio allocates memory based on the ASN.1 length field without checking whether the BIO actually contains that much data, so a short invalid encoding triggers allocation of a huge buffer.
**Steps:**
1. Feed a BIO-based ASN.1 decoder such as `d2i_CMS_bio()` a 7-byte payload: `30 84 30 30 30 30 30`
2. The header declares a SEQUENCE with length 0x30303030
3. Decoder allocates memory for that declared length, consuming CPU, memory and swap
**How found:** Researcher crafted minimal ASN.1 encodings with oversized length fields and observed OpenSSL consuming large amounts of CPU time, memory and swap space.
**Exploitation:** Attacker supplies a tiny malformed ASN.1 blob to any application parsing untrusted data via d2i BIO functions, causing excessive memory/CPU consumption or memory exhaustion (DoS).
**Insight:** BIO-based ASN.1 decoders cannot know total input length upfront, so length fields must be validated incrementally by reading in chunks and detecting unexpected EOF rather than pre-allocating; memory-based decoders (d2i_X509) already sanity-check and are unaffected.