coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge 7d204ac0ef68bd069b1845d421afdee98d72bcab into 3bb373867917b674265067cbd38b9d252c43d014

Browse Source
This commit is contained in:
Ben Taylor 2026-07-20 15:42:16 +01:00 committed by GitHub
commit 33296bbdb2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 41 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog.d/empty-digest-failure.txt Normal file
View File

@ -0,0 +1,4 @@
Bugfix
* Fix PKCS7 so that it successfully parses also in case of empty
or not supported digest algorithms. Validation of the digest algorithm
is performed at validation step.

25
library/pkcs7.c
View File

@ -142,6 +142,10 @@ static int pkcs7_get_digest_algorithm_set(unsigned char **p,
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_ALG, ret);
}
if (len == 0) {
return 0;
}
end = *p + len;
ret = mbedtls_asn1_get_alg_null(p, end, alg);
@ -333,10 +337,15 @@ static int pkcs7_get_signer_info(unsigned char **p, unsigned char *end,
goto out;
}
/* Check that the digest algorithm used matches the one provided earlier */
if (signer->alg_identifier.tag != alg->tag ||
signer->alg_identifier.len != alg->len ||
memcmp(signer->alg_identifier.p, alg->p, alg->len) != 0) {
/*
* If digestAlgorithms is present, require the signer digest algorithm to
* match it. If the outer set is empty, defer the failure until
* verification, where the missing digest algorithm is reported.
*/
if (alg->p != NULL &&
(signer->alg_identifier.tag != alg->tag ||
signer->alg_identifier.len != alg->len ||
memcmp(signer->alg_identifier.p, alg->p, alg->len) != 0)) {
ret = MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO;
goto out;
}
@ -481,9 +490,11 @@ static int pkcs7_get_signed_data(unsigned char *buf, size_t buflen,
return ret;
}
ret = mbedtls_x509_oid_get_md_alg(&signed_data->digest_alg_identifiers, &md_alg);
if (ret != 0) {
return MBEDTLS_ERR_PKCS7_INVALID_ALG;
if (signed_data->digest_alg_identifiers.p != NULL) {
ret = mbedtls_x509_oid_get_md_alg(&signed_data->digest_alg_identifiers, &md_alg);
if (ret != 0) {
return MBEDTLS_ERR_PKCS7_INVALID_ALG;
}
}
mbedtls_pkcs7_buf content_type;

19
tests/suites/test_suite_pkcs7.data
View File

@ -1,3 +1,10 @@
PKCS7 With Empty Digest
pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA
PKCS7 Signed Data Parse Unsupported DigestAlgorithmSet
depends_on:!PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA
PKCS7 Signed Data Parse Pass SHA256 #1
depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA
@ -90,6 +97,18 @@ PKCS7 Signed Data Verification Pass SHA256 #9
depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
PKCS7 Signed Data Verification Fail empty digestAlgorithms
depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_X509_UNKNOWN_OID
PKCS7 Signed Hash Verification Fail empty digestAlgorithms
depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:MBEDTLS_ERR_X509_UNKNOWN_OID
PKCS7 Signed Data Parse Pass SHA256 empty digestAlgorithms
depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA
PKCS7 Signed Data Verification Pass SHA256 #9.1
depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0