From 955de69ed527ff6136e8a152f0102b0b23c1af30 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christopher=20M=C3=BCller?= Date: Sat, 3 Oct 2026 14:28:29 +0200 Subject: [PATCH] x509_crt: accept empty AuthorityKeyIdentifier sequence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All fields of AuthorityKeyIdentifier are OPTIONAL, so an empty SEQUENCE (30 00) is syntactically valid. It was rejected with MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA, because mbedtls_asn1_get_tag() reports OUT_OF_DATA rather than UNEXPECTED_TAG when there is nothing left to parse. Check for the empty sequence explicitly instead of treating OUT_OF_DATA as an absent keyIdentifier: OUT_OF_DATA is also returned for a [0] tag with a missing or truncated length, which must still be rejected. Fixes #10253. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Christopher Müller --- library/x509_crt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/library/x509_crt.c b/library/x509_crt.c index f9e36470cb..cabd76cc49 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -639,6 +639,11 @@ static int x509_get_authority_key_id(unsigned char **p, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); } + /* All fields are OPTIONAL, so an empty SEQUENCE is valid. */ + if (*p == end) { + return 0; + } + ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC);