From 6c9478b2ed406da8ae3aa836fb05b59892be49e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christopher=20M=C3=BCller?= Date: Sat, 26 Sep 2026 10:27:10 +0200 Subject: [PATCH] x509_crt: accept empty AuthorityKeyIdentifier sequence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All fields of AuthorityKeyIdentifier are OPTIONAL, so an empty SEQUENCE (30 00) is syntactically valid. It was rejected with MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA, because mbedtls_asn1_get_tag() reports OUT_OF_DATA rather than UNEXPECTED_TAG when there is nothing left to parse. Check for the empty sequence explicitly instead of treating OUT_OF_DATA as an absent keyIdentifier: OUT_OF_DATA is also returned for a [0] tag with a missing or truncated length, which must still be rejected. Fixes #10253. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Christopher Müller --- library/x509_crt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/library/x509_crt.c b/library/x509_crt.c index a6fcd1b4e6..2309e37de0 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -638,6 +638,11 @@ static int x509_get_authority_key_id(unsigned char **p, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); } + /* All fields are OPTIONAL, so an empty SEQUENCE is valid. */ + if (*p == end) { + return 0; + } + ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC);