From 4d6e33b1ddcee4396342541fbd65f7e865f1e96f Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Wed, 1 Apr 2020 21:31:06 -0500
Subject: [PATCH] Fix wc_KeyPemToDer with PKCS1 and empty key

---
 tests/api.c         | 21 +++++++++++++++++++++
 wolfcrypt/src/asn.c | 28 ++++++++++++++++++----------
 2 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/tests/api.c b/tests/api.c
index 6130a329f..501d44b2f 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -25671,6 +25671,27 @@ static void test_wolfSSL_RSA(void)
     AssertNull(RSA_generate_key(4097, 3, NULL, NULL)); /* RSA_MAX_SIZE + 1 */
     AssertNull(RSA_generate_key(2048, 0, NULL, NULL));
 
+
+#if !defined(NO_FILESYSTEM) && !defined(NO_ASN)
+    {
+        byte buff[FOURK_BUF];
+        byte der[FOURK_BUF];
+        const char PrivKeyPemFile[] = "certs/client-keyEnc.pem";
+
+        XFILE f;
+        int bytes;
+
+        /* test loading encrypted RSA private pem w/o password */
+        f = XFOPEN(PrivKeyPemFile, "rb");
+        AssertTrue((f != XBADFILE));
+        bytes = (int)XFREAD(buff, 1, sizeof(buff), f);
+        XFCLOSE(f);
+        memset(der, 0, sizeof(der));
+        /* test that error value is returned with no password */
+        AssertIntLT(wc_KeyPemToDer(buff, bytes, der, (word32)sizeof(der), ""), 0);
+    }
+#endif
+
     printf(resultFmt, passed);
 #endif
 }
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index d6e58946e..0a8fcdc49 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -10562,20 +10562,28 @@ int PemToDer(const unsigned char* buff, long longSz, int type,
             }
             /* decrypt the key */
             else {
-                ret = wc_BufferKeyDecrypt(info, der->buffer, der->length,
-                    (byte*)password, passwordSz, WC_MD5);
+                int length;
+                word32 inOutIdx = 0;
+                if ((passwordSz == 0) &&
+                    (GetSequence(der->buffer, &inOutIdx, &length,
+                            der->length) < 0)) {
+                    ret = ASN_PARSE_E;
+                }
+                else {
+                    ret = wc_BufferKeyDecrypt(info, der->buffer, der->length,
+                        (byte*)password, passwordSz, WC_MD5);
 
 #ifndef NO_WOLFSSL_SKIP_TRAILING_PAD
-            #ifndef NO_DES3
-                if (info->cipherType == WC_CIPHER_DES3) {
-                    padVal = der->buffer[der->length-1];
-                    if (padVal <= DES_BLOCK_SIZE) {
-                        der->length -= padVal;
+                #ifndef NO_DES3
+                    if (info->cipherType == WC_CIPHER_DES3) {
+                        padVal = der->buffer[der->length-1];
+                        if (padVal <= DES_BLOCK_SIZE) {
+                            der->length -= padVal;
+                        }
                     }
-                }
-            #endif /* !NO_DES3 */
+                #endif /* !NO_DES3 */
 #endif /* !NO_WOLFSSL_SKIP_TRAILING_PAD */
-
+                }
             }
 #ifdef OPENSSL_EXTRA
             if (ret) {