Repository navigation
x509: stricter parsing - #22799
x509: stricter parsing#22799icing wants to merge 6 commits into
Conversation
Check that the "validity" ASN.1 field has a length matching the contained date elements and fail the parsing otherwise. This is a precaution against malformed cert data that should have been caught by the TLS backend already. A bit added defense.
|
How about adding something to unit test 1657 for this as well? |
I can add a malformed cert PEM into the test, but that makes binary data in our source...meh. Constructing a cert ASN.1 via code is not for the faint of heart. I mean, it can be done, but... Any idea? |
- make DER data args type uint8_t - add PEMs to test1657 for certificate parse checks (not a fan of the binary blobs)
If you're open to an external tool I've used der-ascii for this sort of thing in the past. You could check in the If you don't need a valid signature it's also helpful for making annoying mutations to get invalid DER that are hard to do with smarter tools. |
|
Thanks, @cpu! Found Hmm. I think I'll stick with adding the PEM into the unit tests for now, not requiring external tools on all our test platforms. |
3 participants
Check that the "validity" ASN.1 field has a length matching the contained date elements and fail the parsing otherwise.
This is a precaution against malformed cert data that should have been caught by the TLS backend already. A bit added defense.