coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

x509_crt: accept empty AuthorityKeyIdentifier sequence

Browse Source 
All fields of AuthorityKeyIdentifier are OPTIONAL, so an empty SEQUENCE
(30 00) is syntactically valid. It was rejected with
MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA,
because mbedtls_asn1_get_tag() reports OUT_OF_DATA rather than
UNEXPECTED_TAG when there is nothing left to parse.

Check for the empty sequence explicitly instead of treating OUT_OF_DATA
as an absent keyIdentifier: OUT_OF_DATA is also returned for a [0] tag
with a missing or truncated length, which must still be rejected.

Fixes #10253.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Christopher Müller <chris@mechatronikmonkey.de>
This commit is contained in:
Christopher Müller 2026-10-03 14:28:34 +02:00
parent 77eacf4c93
commit a8fda00a13
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
library/x509_crt.c
View File

@ -638,6 +638,11 @@ static int x509_get_authority_key_id(unsigned char **p,
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
}
/* All fields are OPTIONAL, so an empty SEQUENCE is valid. */
if (*p == end) {
return 0;
}
ret = mbedtls_asn1_get_tag(p, end, &len,
MBEDTLS_ASN1_CONTEXT_SPECIFIC);