[ruby/openssl] asn1: limit nesting depth in OpenSSL::ASN1.decodeHEADmaster

Feeding a deeply nested constructed encoding to OpenSSL::ASN1.decode,
.decode_all, or .traverse can cause unbounded recursion and result in
SystemStackError.

Add an explicit nesting depth limit of 200 levels and raise
OpenSSL::ASN1::ASN1Error if it is exceeded. This limit is arbitrary and
currently not configurable, but should be sufficient for any practical
use cases.

Fixes https://hackerone.com/reports/3662125

https://github.com/ruby/openssl/commit/fc753239cc

0 files changed, 0 insertions, 0 deletions