Description
On Darwin, platform certificate verification passes VerifyOptions.DNSName to CoreFoundation/Security.framework policy creation. Invalid UTF-8 hostname input can reach a platform failure path and crash the process instead of returning a Go verification error.
The input is caller-supplied, so impact depends on an application passing attacker-controlled invalid UTF-8 hostnames into verification.
Specification or documentation
This is a Go API robustness issue. Certificate.Verify and platform verification should return errors for invalid verification inputs rather than crashing the process.
Code references
go/src/crypto/x509/root_darwin.go:16 defines Darwin systemVerify.go/src/crypto/x509/root_darwin.go:40 calls macos.SecPolicyCreateSSL(opts.DNSName).go/src/crypto/x509/internal/macos/security.go:71 through go/src/crypto/x509/internal/macos/security.go:79 builds the platform SSL policy from the provided string.
Test case
This should be a Darwin-only X.509 platform test: call Certificate.Verify with VerifyOptions.DNSName containing invalid UTF-8 and assert that verification returns an error instead of crashing.
It is platform-specific and belongs in Darwin X.509 tests.
Description
On Darwin, platform certificate verification passes
VerifyOptions.DNSNameto CoreFoundation/Security.framework policy creation. Invalid UTF-8 hostname input can reach a platform failure path and crash the process instead of returning a Go verification error.The input is caller-supplied, so impact depends on an application passing attacker-controlled invalid UTF-8 hostnames into verification.
Specification or documentation
This is a Go API robustness issue.
Certificate.Verifyand platform verification should return errors for invalid verification inputs rather than crashing the process.Code references
go/src/crypto/x509/root_darwin.go:16defines DarwinsystemVerify.go/src/crypto/x509/root_darwin.go:40callsmacos.SecPolicyCreateSSL(opts.DNSName).go/src/crypto/x509/internal/macos/security.go:71throughgo/src/crypto/x509/internal/macos/security.go:79builds the platform SSL policy from the provided string.Test case
This should be a Darwin-only X.509 platform test: call
Certificate.VerifywithVerifyOptions.DNSNamecontaining invalid UTF-8 and assert that verification returns an error instead of crashing.It is platform-specific and belongs in Darwin X.509 tests.