mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-10-19 02:21:27 +00:00
12f62fb82c
When parsing a substructure of an ASN.1 structure, no field within the substructure must exceed the bounds of the substructure. Concretely, the `end` pointer passed to the ASN.1 parsing routines must be updated to point to the end of the substructure while parsing the latter. This was previously not the case for the routines - x509_get_attr_type_and_value(), - mbedtls_x509_get_crt_ext(), - mbedtls_x509_get_crl_ext(). These functions kept using the end of the parent structure as the `end` pointer and would hence allow substructure fields to cross the substructure boundary. This could lead to successful parsing of ill-formed X.509 CRTs. This commit fixes this. Care has to be taken when adapting `mbedtls_x509_get_crt_ext()` and `mbedtls_x509_get_crl_ext()`, as the underlying function `mbedtls_x509_get_ext()` returns `0` if no extensions are present but doesn't set the variable which holds the bounds of the Extensions structure in case the latter is present. This commit addresses this by returning early from `mbedtls_x509_get_crt_ext()` and `mbedtls_x509_get_crl_ext()` if parsing has reached the end of the input buffer. The following X.509 parsing tests need to be adapted: - "TBSCertificate, issuer two inner set datas" This test exercises the X.509 CRT parser with a Subject name which has two empty `AttributeTypeAndValue` structures. This is supposed to fail with `MBEDTLS_ERR_ASN1_OUT_OF_DATA` because the parser should attempt to parse the first structure and fail because of a lack of data. Previously, it failed to obey the (0-length) bounds of the first AttributeTypeAndValue structure and would try to interpret the beginning of the second AttributeTypeAndValue structure as the first field of the first AttributeTypeAndValue structure, returning an UNEXPECTED_TAG error. - "TBSCertificate, issuer, no full following string" This test exercises the parser's behaviour on an AttributeTypeAndValue structure which contains more data than expected; it should therefore fail with MBEDTLS_ERR_ASN1_LENGTH_MISMATCH. Because of the missing bounds check, it previously failed with UNEXPECTED_TAG because it interpreted the remaining byte in the first AttributeTypeAndValue structure as the first byte in the second AttributeTypeAndValue structure. - "SubjectAltName repeated" This test should exercise two SubjectAltNames extensions in succession, but a wrong length values makes the second SubjectAltNames extension appear outside of the Extensions structure. With the new bounds in place, this therefore fails with a LENGTH_MISMATCH error. This commit adapts the test data to put the 2nd SubjectAltNames extension inside the Extensions structure, too. |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| aes.c | ||
| aesni.c | ||
| arc4.c | ||
| aria.c | ||
| asn1parse.c | ||
| asn1write.c | ||
| base64.c | ||
| bignum.c | ||
| blowfish.c | ||
| camellia.c | ||
| ccm.c | ||
| certs.c | ||
| chacha20.c | ||
| chachapoly.c | ||
| cipher.c | ||
| cipher_wrap.c | ||
| cmac.c | ||
| CMakeLists.txt | ||
| ctr_drbg.c | ||
| debug.c | ||
| des.c | ||
| dhm.c | ||
| ecdh.c | ||
| ecdsa.c | ||
| ecjpake.c | ||
| ecp.c | ||
| ecp_curves.c | ||
| entropy.c | ||
| entropy_poll.c | ||
| error.c | ||
| gcm.c | ||
| havege.c | ||
| hkdf.c | ||
| hmac_drbg.c | ||
| Makefile | ||
| md.c | ||
| md2.c | ||
| md4.c | ||
| md5.c | ||
| md_wrap.c | ||
| memory_buffer_alloc.c | ||
| net_sockets.c | ||
| nist_kw.c | ||
| oid.c | ||
| padlock.c | ||
| pem.c | ||
| pk.c | ||
| pk_wrap.c | ||
| pkcs5.c | ||
| pkcs11.c | ||
| pkcs12.c | ||
| pkparse.c | ||
| pkwrite.c | ||
| platform.c | ||
| platform_util.c | ||
| poly1305.c | ||
| ripemd160.c | ||
| rsa.c | ||
| rsa_internal.c | ||
| sha1.c | ||
| sha256.c | ||
| sha512.c | ||
| ssl_cache.c | ||
| ssl_ciphersuites.c | ||
| ssl_cli.c | ||
| ssl_cookie.c | ||
| ssl_srv.c | ||
| ssl_ticket.c | ||
| ssl_tls.c | ||
| threading.c | ||
| timing.c | ||
| version.c | ||
| version_features.c | ||
| x509.c | ||
| x509_create.c | ||
| x509_crl.c | ||
| x509_crt.c | ||
| x509_csr.c | ||
| x509write_crt.c | ||
| x509write_csr.c | ||
| xtea.c | ||