Patched code sample

import sys

# In the actual library, this limit is defined at the module level.
# It protects against CPU-intensive computation of maliciously large tag IDs.
MAX_TAG_ID_OCTETS = 64

class BerDecoderError(Exception):
    pass

def fixed_decode_long_tag(substrate_bytes):
    """
    This function represents the fixed logic from pyasn1's BER decoder.

    It processes continuation octets for a long-form ASN.1 tag and includes
    a boundary check to prevent denial-of-service attacks.
    """
    tag_id = 0
    octet_count = 0

    while octet_count < len(substrate_bytes):
        octet = substrate_bytes[octet_count]
        octet_count += 1

        # The core of the vulnerability fix: an upper bound on processed octets.
        # The vulnerable code lacked this check, allowing an infinite loop for
        # crafted input.
        if octet_count > MAX_TAG_ID_OCTETS:
            raise BerDecoderError(
                f"Tag identifier is too large (> {MAX_TAG_ID_OCTETS} octets)"
            )

        # Accumulate the 7-bit parts of the tag ID
        tag_id = (tag_id << 7) | (octet & 0x7F)

        # If the most significant bit is 0, this is the last octet for the tag
        if not (octet & 0x80):
            return tag_id

    # If the loop ends but the last octet indicated a continuation, it's an error
    raise BerDecoderError("Malformed tag: unterminated sequence")