crypto/x509: CertPool.Subjects exposes mutable internal subject slices

[jvdprng]

Description

CertPool.Subjects allocates a new outer slice but returns inner byte slices that alias the pool's internal rawSubject storage. A caller that mutates a returned subject slice can mutate the pool metadata observed by later calls.

This requires the application to mutate its own returned data.

Specification or documentation

This is a Go API aliasing issue. The Subjects documentation says it returns a list of DER-encoded subjects, but it does not warn that mutating the returned inner slices mutates pool internals.

Code references

• go/src/crypto/x509/cert_pool.go:257 through go/src/crypto/x509/cert_pool.go:262 documents and defines Subjects.
• go/src/crypto/x509/cert_pool.go:263 allocates a new outer slice.
• go/src/crypto/x509/cert_pool.go:264 through go/src/crypto/x509/cert_pool.go:266 returns lc.rawSubject directly.
• go/src/crypto/x509/cert_pool.go:40 through go/src/crypto/x509/cert_pool.go:45 defines rawSubject as internal metadata.

Test case

This should be a Go unit test: add a certificate to a pool, call Subjects, mutate a returned inner slice, call Subjects again, and assert that the pool's subject bytes did not change.

[gabyhelp]

Related Issues

• crypto/tls: weak certificate cache can expose caller-mutated certificate bytes #79863
• crypto/x509: allow certificates to be exported from CertPool #26613 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jvdprng]

Playground reproducer: https://go.dev/play/p/FQkM_yQMQpZ

[cherrymui]

cc @golang/security