ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure.

I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from any programmer error. I think the best way to do this is to use a managed language that does not use unsafe code.

Are there any managed implementations (C#) of an ASN.1 parser that is well tested and safe from buffer overflows. Even better if there was a way to detect such an overflow to begin with.

  • Ever heard of valgrind? – Florian Margaine Jul 22 '13 at 16:15
  • 1
    @FlorianMargaine - I fail to understand your reference. valgrind doesn't work with CLR. – Deer Hunter Jul 22 '13 at 16:27
  • I'm just saying that valgrind helps avoid overflows in un-managed languages, such as C/C++. Besides, C++ is almost a managed language nowadays. – Florian Margaine Jul 22 '13 at 16:37
  • Valgrind helps - its not the answer, otherwise all you would need to write software such as Avionics is a clean Valgrind report..... – mattnz Jul 22 '13 at 21:35

Please take a look at http://www.itu.int/ITU-T/asn1/links/index.htm which has an excellent list of ASN.1 tools (some commercial, some free), some of which are widely used in critical infrastructure around the world.

One of these vendors (who I work for) is OSS Nokalva (http://www.oss.com) where you can find ASN.1 Tools for C, C++, C# and Java for which you can download free trials.

Please note that just using a language like C# or Java is no guarantee against maliciously formed ASN.1 encoded messages. Well written code and thorough enough testing can ensure that code is solid. The wide deployment of ASN.1 software in many critical applications is a testament to how well written some ASN.1 engines are. Note that you are more likely to find robust code from a widely used commercial ASN.1 Tool (which includes technical support) than from some of the free ASN.1 Tools which are available.

|improve this answer|||||
  • 3
    That's why I love this site: professionals working in the field answering. – Florian Margaine Jul 22 '13 at 18:52
  • +1 for "...language like C# or Java is no guarantee against maliciously formed...." – mattnz Jul 22 '13 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.