From e31a4f78208feedfdd31b7dbd45be96993b3be03 Mon Sep 17 00:00:00 2001 From: Saurabh Dwivedy Date: Wed, 22 Jul 2026 00:33:31 +0400 Subject: [PATCH] x509:reject certificates with a zero serial number (RFC 5280) --- library/x509_crt.c | 15 +++++++++++++++ tests/suites/test_suite_x509parse.data | 3 +++ 2 files changed, 18 insertions(+) diff --git a/library/x509_crt.c b/library/x509_crt.c index a6fcd1b4e6..699fba0456 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -1161,6 +1161,21 @@ static int x509_crt_parse_der_core(mbedtls_x509_crt *crt, mbedtls_x509_crt_free(crt); return ret; } + + { + size_t i; + int is_serial_zero = 1; + for(i = 0; i < crt->serial.len; i++) { + if(crt->serial.p[i] != 0) { + is_serial_zero = 0; + break; + } + } + if(is_serial_zero) { + mbedtls_x509_crt_free(crt); + return MBEDTLS_ERR_X509_INVALID_SERIAL; + } + } if (crt->version < 0 || crt->version > 2) { mbedtls_x509_crt_free(crt); diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index 3750e0a5d3..f5a22aab9b 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -3186,6 +3186,9 @@ X509 File parse (RSASSA-PSS, MGF1 hash alg != message hash alg) depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_SHA_224:PSA_WANT_ALG_SHA_1 x509parse_crt_file:"../framework/data_files/server9-bad-mgfhash.crt":MBEDTLS_ERR_X509_INVALID_ALG +X509 File parse (Certificate serial number is zero, RFC 5280 violation) +x509parse_crt_file:"../framework/data_files/parse_input/cert_serial_zero.crt":MBEDTLS_ERR_X509_INVALID_SERIAL + X509 File parse & read the ca_istrue field (Not Set) depends_on:MBEDTLS_PEM_PARSE_C:PSA_HAVE_ALG_SOME_RSA_VERIFY:MBEDTLS_HAVE_TIME_DATE:PSA_WANT_ALG_SHA_1 mbedtls_x509_get_ca_istrue:"../framework/data_files/parse_input/server1.crt":0