wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-02 12:14:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixes for ASN original (old) to support checking int leading 0 and invalid OID. Disable invalid UTF8 test for old ASN (only supported with newer ASN template).

Browse Source
This commit is contained in:
David Garske
2024-07-24 12:35:37 -07:00
parent 4b9d89d387
commit 7f7d94abd5
2 changed files with 28 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
wolfcrypt/src/asn.c
View File

@@ -2430,6 +2430,19 @@ static int GetASNHeader_ex(const byte* input, byte tag, word32* inOutIdx,
if ((ret == 0) && (GetLength_ex(input, &idx, &length, maxIdx, check) < 0)) { if ((ret == 0) && (GetLength_ex(input, &idx, &length, maxIdx, check) < 0)) {
ret = ASN_PARSE_E; ret = ASN_PARSE_E;
} }
if (ret == 0 && tag == ASN_OBJECT_ID) {
if (length < 3) {
/* OID data must be at least 3 bytes. */
WOLFSSL_MSG("OID length less than 3");
ret = ASN_PARSE_E;
}
else if ((input[(int)idx + length - 1] & 0x80) != 0x00) {
/* Last octet of a sub-identifier has bit 8 clear. Last octet must be
* last of a subidentifier. Ensure last octet hasn't got top bit set. */
WOLFSSL_MSG("OID last octet has top bit set");
ret = ASN_PARSE_E;
}
}
if (ret == 0) { if (ret == 0) {
/* Return the length of data and index after header. */ /* Return the length of data and index after header. */
*len = length; *len = length;
@@ -2691,14 +2704,15 @@ int GetASNInt(const byte* input, word32* inOutIdx, int* len,
return ret; return ret;
if (*len > 0) { if (*len > 0) {
#ifndef WOLFSSL_ASN_INT_LEAD_0_ANY #ifndef WOLFSSL_ASN_INT_LEAD_0_ANY
/* check for invalid padding on negative integer. /* check for invalid padding on negative integer.
* c.f. X.690 (ISO/IEC 8825-2:2003 (E)) 10.4.6; RFC 5280 4.1 * c.f. X.690 (ISO/IEC 8825-2:2003 (E)) 10.4.6; RFC 5280 4.1
*/ */
if (*len > 1) { if (*len > 1) {
if ((input[*inOutIdx] == 0xff) && (input[*inOutIdx + 1] & 0x80)) if ((input[*inOutIdx] == 0xff) && (input[*inOutIdx + 1] & 0x80)) {
return ASN_PARSE_E; WOLFSSL_MSG("Bad INTEGER encoding of negative");
return ASN_EXPECT_0_E;
}
} }
#endif #endif
@@ -2708,8 +2722,10 @@ int GetASNInt(const byte* input, word32* inOutIdx, int* len,
(*len)--; (*len)--;
#ifndef WOLFSSL_ASN_INT_LEAD_0_ANY #ifndef WOLFSSL_ASN_INT_LEAD_0_ANY
if (*len > 0 && (input[*inOutIdx] & 0x80) == 0) if (*len > 0 && (input[*inOutIdx] & 0x80) == 0) {
return ASN_PARSE_E; WOLFSSL_MSG("INTEGER is negative");
return ASN_EXPECT_0_E;
}
#endif #endif
} }
} }
@@ -11572,9 +11588,11 @@ static int GetCertHeader(DecodedCert* cert)
cert->sigIndex) < 0) cert->sigIndex) < 0)
return ASN_PARSE_E; return ASN_PARSE_E;
if (wc_GetSerialNumber(cert->source, &cert->srcIdx, cert->serial, ret = wc_GetSerialNumber(cert->source, &cert->srcIdx, cert->serial,
&cert->serialSz, cert->sigIndex) < 0) &cert->serialSz, cert->sigIndex);
return ASN_PARSE_E; if (ret < 0) {
return ret;
}
return ret; return ret;
} }

4
wolfcrypt/test/test.c
View File

@@ -18078,7 +18078,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t memory_test(void)
#endif #endif
static const char* certBadOid = static const char* certBadOid =
CERT_ROOT "test" CERT_PATH_SEP "cert-bad-oid.der"; CERT_ROOT "test" CERT_PATH_SEP "cert-bad-oid.der";
#ifndef WOLFSSL_NO_ASN_STRICT #if defined(WOLFSSL_ASN_TEMPLATE) && !defined(WOLFSSL_NO_ASN_STRICT)
static const char* certBadUtf8 = static const char* certBadUtf8 =
CERT_ROOT "test" CERT_PATH_SEP "cert-bad-utf8.der"; CERT_ROOT "test" CERT_PATH_SEP "cert-bad-utf8.der";
#endif #endif
@@ -18383,7 +18383,7 @@ static wc_test_ret_t cert_bad_asn1_test(void)
/* Subject name OID: 55 04 f4. Last byte with top bit set invalid. */ /* Subject name OID: 55 04 f4. Last byte with top bit set invalid. */
ret = cert_load_bad(certBadOid, tmp, ASN_PARSE_E); ret = cert_load_bad(certBadOid, tmp, ASN_PARSE_E);
} }
#ifndef WOLFSSL_NO_ASN_STRICT #if defined(WOLFSSL_ASN_TEMPLATE) && !defined(WOLFSSL_NO_ASN_STRICT)
if (ret == 0) { if (ret == 0) {
/* Issuer name UTF8STRING: df 52 4e 44. Top bit of second byte not set. /* Issuer name UTF8STRING: df 52 4e 44. Top bit of second byte not set.
*/ */