From 4d2b505cad24129382571749b77a9ff7c0b760ee Mon Sep 17 00:00:00 2001 From: Naveed Date: Fri, 2 Oct 2026 16:57:27 +0530 Subject: [PATCH] Reject a CSR whose CertificationRequestInfo is not fully consumed The certificate and CRL parsers already reject the equivalent input before widening end back to the whole buffer. Signed-off-by: Naveed --- ChangeLog.d/x509-csr-parse-cri-length.txt | 6 ++++++ library/x509_csr.c | 6 ++++++ tests/suites/test_suite_x509parse.data | 4 ++++ 3 files changed, 16 insertions(+) create mode 100644 ChangeLog.d/x509-csr-parse-cri-length.txt diff --git a/ChangeLog.d/x509-csr-parse-cri-length.txt b/ChangeLog.d/x509-csr-parse-cri-length.txt new file mode 100644 index 0000000000..feca82ddec --- /dev/null +++ b/ChangeLog.d/x509-csr-parse-cri-length.txt @@ -0,0 +1,6 @@ +Bugfix + * Reject a certificate signing request whose CertificationRequestInfo + length runs past the fields it contains, instead of accepting it and + reporting a CertificationRequestInfo (mbedtls_x509_csr::cri) that + covers the signature. The certificate and CRL parsers already rejected + the equivalent input. diff --git a/library/x509_csr.c b/library/x509_csr.c index 28a4560c43..54e9bbdac5 100644 --- a/library/x509_csr.c +++ b/library/x509_csr.c @@ -405,6 +405,12 @@ static int mbedtls_x509_csr_parse_der_internal(mbedtls_x509_csr *csr, p += len; + if (p != end) { + mbedtls_x509_csr_free(csr); + return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); + } + end = csr->raw.p + csr->raw.len; /* diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index 6a8e30f524..527a06b243 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -2967,6 +2967,10 @@ X509 CSR ASN.1 (extensionRequest SET length too short) depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256 mbedtls_x509_csr_parse:"308201183081bf0201003034310b3009060355040613024e4c3111300f060355040a1308506f6c617253534c31123010060355040313096c6f63616c686f73743059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa029302706092a864886f70d01090e3119301830090603551d1304023000300b0603551d0f0404030205e0300906072a8648ce3d04010349003046022100b49fd8c8f77abfa871908dfbe684a08a793d0f490a43d86fcf2086e4f24bb0c2022100f829d5ccd3742369299e6294394717c4b723a0f68b44e831b6e6c3bcabf97243":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) +X509 CSR ASN.1 (CRI length runs past the parsed fields) +depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256 +mbedtls_x509_csr_parse:"30820119308201150201003034310b3009060355040613024e4c3111300f060355040a1308506f6c617253534c31123010060355040313096c6f63616c686f73743059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa029302706092a864886f70d01090e311a301830090603551d1304023000300b0603551d0f0404030205e0300906072a8648ce3d04010349003046022100b49fd8c8f77abfa871908dfbe684a08a793d0f490a43d86fcf2086e4f24bb0c2022100f829d5ccd3742369299e6294394717c4b723a0f68b44e831b6e6c3bcabf97243":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) + X509 CSR ASN.1 (Unsupported critical extension, critical=true) depends_on:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256:!MBEDTLS_X509_REMOVE_INFO mbedtls_x509_csr_parse:"308201233081cb02010030413119301706035504030c1053656c66207369676e65642074657374310b300906035504061302444531173015060355040a0c0e41757468437274444220546573743059301306072a8648ce3d020106082a8648ce3d03010703420004c11ebb9951848a436ca2c8a73382f24bbb6c28a92e401d4889b0c361f377b92a8b0497ff2f5a5f6057ae85f704ab1850bef075914f68ed3aeb15a1ff1ebc0dc6a028302606092a864886f70d01090e311930173015060b2b0601040183890c8622020101ff0403010101300a06082a8648ce3d040302034700304402200c4108fd098525993d3fd5b113f0a1ead8750852baf55a2f8e670a22cabc0ba1022034db93a0fcb993912adcf2ea8cb4b66389af30e264d43c0daea03255e45d2ccc":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)