From d00c97ddeaa90c6cff8affa46f47bbef7cb64d6b Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Thu, 20 Nov 2025 11:53:39 +0100
Subject: [PATCH 1/2] object: Avoid crashing on zero-length AllowedMechanisms
 attribute

As returned by SoftHSM: https://github.com/softhsm/SoftHSMv2/issues/825

Fixes: #323

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
---
 cryptoki/src/object.rs | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/cryptoki/src/object.rs b/cryptoki/src/object.rs
index 463a1007..89278855 100644
--- a/cryptoki/src/object.rs
+++ b/cryptoki/src/object.rs
@@ -1114,18 +1114,25 @@ impl TryFrom<CK_ATTRIBUTE> for Attribute {
                 Ok(Attribute::ValidationVersion(Version::new(val[0], val[1])))
             }
             AttributeType::AllowedMechanisms => {
-                let val = unsafe {
-                    std::slice::from_raw_parts(
-                        attribute.pValue as *const CK_MECHANISM_TYPE,
-                        attribute.ulValueLen.try_into()?,
-                    )
-                };
-                let types: Vec<MechanismType> = val
-                    .iter()
-                    .copied()
-                    .map(|t| t.try_into())
-                    .collect::<Result<Vec<MechanismType>>>()?;
-                Ok(Attribute::AllowedMechanisms(types))
+                if attribute.ulValueLen == 0 {
+                    /* For zero-length attributes we are getting pointer to static
+                     * buffer of length zero, which can not be used to create slices.
+                     * Short-circuit here to avoid crash (#324) */
+                    Ok(Attribute::AllowedMechanisms(Vec::<MechanismType>::new()))
+                } else {
+                    let val = unsafe {
+                        std::slice::from_raw_parts(
+                            attribute.pValue as *const CK_MECHANISM_TYPE,
+                            attribute.ulValueLen.try_into()?,
+                        )
+                    };
+                    let types: Vec<MechanismType> = val
+                        .iter()
+                        .copied()
+                        .map(|t| t.try_into())
+                        .collect::<Result<Vec<MechanismType>>>()?;
+                    Ok(Attribute::AllowedMechanisms(types))
+                }
             }
             AttributeType::EndDate => {
                 if val.is_empty() {

From 0204b083918350c84d7c1023022df72acdf0fbfa Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Thu, 20 Nov 2025 11:50:56 +0100
Subject: [PATCH 2/2] tests: Reproducer for empty AllowedMechanisms issue with
 SoftHSM

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
---
 cryptoki/tests/basic.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/cryptoki/tests/basic.rs b/cryptoki/tests/basic.rs
index f6bbde4f..cb390478 100644
--- a/cryptoki/tests/basic.rs
+++ b/cryptoki/tests/basic.rs
@@ -1113,6 +1113,20 @@ fn import_export() -> TestResult {
         panic!("Expected the Modulus attribute.");
     }
 
+    let mut attrs =
+        session.get_attributes(is_it_the_public_key, &[AttributeType::AllowedMechanisms])?;
+
+    if is_softhsm() {
+        let attr = attrs.remove(0);
+        if let Attribute::AllowedMechanisms(v) = attr {
+            assert_eq!(v, Vec::<MechanismType>::new());
+        } else {
+            panic!("Expected the AllowedMechanisms attribute.");
+        }
+    } else {
+        assert_eq!(attrs, Vec::<Attribute>::new());
+    }
+
     // delete key
     session.destroy_object(is_it_the_public_key)?;