Re: [media-types] Update of MIME media type application/pkcs7-mime Registration

[Henrik Andersson <[e-mail]>]

Sean Turner skriver:
> 
> ASN.1 encoding rules (e.g., DER and BER) have a type-length-value
> structure, and it is easy to construct malicious content with invalid
> length fields that can cause buffer overrun conditions. ASN.1 encoding
> rules allows for arbitrary levels of nesting, which may make it possible
> to construct malicious content that will cause a stack overflow.
> Interpreters of ASN.1 structures should be aware of these issues and
> should take appropriate measures to guard against buffer overflows and
> stack overruns in particular and malicious content in general.
> 

Lots of formats have explicit length fields and nested structures.
Parsers are expected to know how to deal with malformed data of this type.

I don't think a warning of this kind is necessary, because if it was
then pretty much all formats requiring binary transfer considerations
(and then some!) would need it.