Skip to content

Fix double-layered DER decoding when reading X.509 certificate extension OIDs #3780

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kasemir merged 1 commit into from
Apr 15, 2026
+21 −3
Merged

Fix double-layered DER decoding when reading X.509 certificate extension OIDs #3780

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions core/pva/src/main/java/org/epics/pva/common/SecureSockets.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,8 +274,13 @@
{
if (der_value == null)
return "";
// https://en.wikipedia.org/wiki/X.690#DER_encoding:
// Type 4, length 0..127, characters
// X509Certificate.getExtensionValue() returns a DER OCTET STRING
// that wraps the actual extension content.
// The extension content itself is a DER-encoded string
// (OCTET STRING 0x04 or UTF8String 0x0C), so we must unwrap two layers:
// Outer: 0x04 <len> <inner DER>
// Inner: 0x04|0x0C <len> <actual string bytes>
// https://en.wikipedia.org/wiki/X.690#DER_encoding
if (der_value.length < 2)
throw new Exception("Need DER type and size, only received " + der_value.length + " bytes");
if (der_value[0] != 0x04)
Expand All @@ -284,7 +289,20 @@
throw new Exception("Can only handle strings of length 0-127, got " + der_value[1]);
if (der_value[1] != der_value.length-2)
throw new Exception("DER string length " + der_value[1] + " but " + (der_value.length-2) + " data items");
return new String(der_value, 2, der_value[1]);

// Unwrap outer OCTET STRING to get the inner DER-encoded string
final int inner_offset = 2;
final int inner_len = der_value.length - 2;
if (inner_len < 2)
throw new Exception("Inner DER too short: " + inner_len + " bytes");

Check warning on line 297 in core/pva/src/main/java/org/epics/pva/common/SecureSockets.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace generic exceptions with specific library exceptions or a custom exception. 


See more on https://sonarcloud.io/project/issues?id=ControlSystemStudio_phoebus&issues=AZ2RmOw89HqeQjTAuXIO&open=AZ2RmOw89HqeQjTAuXIO&pullRequest=3780
final byte inner_tag = der_value[inner_offset];
// Accept OCTET STRING (0x04), UTF8String (0x0C), or IA5String (0x16) as inner type
if (inner_tag != 0x04 && inner_tag != 0x0C && inner_tag != 0x16)
throw new Exception(String.format("Expected inner DER string type 0x04, 0x0C, or 0x16, got 0x%02X", inner_tag));

Check warning on line 301 in core/pva/src/main/java/org/epics/pva/common/SecureSockets.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace generic exceptions with specific library exceptions or a custom exception. 


See more on https://sonarcloud.io/project/issues?id=ControlSystemStudio_phoebus&issues=AZ2RmOw89HqeQjTAuXIP&open=AZ2RmOw89HqeQjTAuXIP&pullRequest=3780
final int str_len = der_value[inner_offset + 1] & 0xFF;
if (str_len != inner_len - 2)
throw new Exception("Inner DER string length " + str_len + " but " + (inner_len-2) + " data bytes");

Check warning on line 304 in core/pva/src/main/java/org/epics/pva/common/SecureSockets.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace generic exceptions with specific library exceptions or a custom exception. 


See more on https://sonarcloud.io/project/issues?id=ControlSystemStudio_phoebus&issues=AZ2RmOw89HqeQjTAuXIQ&open=AZ2RmOw89HqeQjTAuXIQ&pullRequest=3780
return new String(der_value, inner_offset + 2, str_len);
}

/** Get CN from principal
Expand Down