Merge b6707174aa3e1ae8c219bc248232759eb17abc02 into 03e1438089654fb884ac48e0f3cd0049cfe2c102

Fix resource leak in populate transform

ChangeLog.d/fix-ENABLE_PROGRAMS-bug.txt

@@ -0,0 +1,2 @@
+Bugfix
+   * Fix failure of cmake -DENABLE_PROGRAMS=OFF. Fixes #10587.

ChangeLog.d/tls12-handshake-length-read-bounds.txt

@@ -0,0 +1,10 @@
+Bugfix
+   * Fix a buffer over-read when parsing a TLS 1.2 ClientHello or
+     CertificateRequest that is truncated inside the two-byte length field
+     of the ciphersuite list (server side) or of the certificate
+     authorities list (client side): the length checks preceding those
+     fields reserved too few bytes, so the length field could be read past
+     the end of the message. Such messages are now rejected before the
+     read.
+   * The TLS 1.2 client now rejects a CertificateRequest message whose
+     supported_signature_algorithms list has an odd length.

ChangeLog.d/tls13-transform-resource-leak.txt

@@ -0,0 +1,4 @@
+Bugfix
+   * Fix a resource leak in TLS 1.3 transform setup when importing the
+     decryption traffic key fails after the encryption traffic key has already
+     been imported. Fixes #10917.

ChangeLog.d/x509-empty-authority-key-id.txt

@@ -0,0 +1,7 @@
+Bugfix
+   * Accept X.509 certificates whose AuthorityKeyIdentifier extension is an
+     empty SEQUENCE. All of its fields are optional, so such certificates
+     are syntactically valid, but they were rejected with
+     MBEDTLS_ERR_X509_INVALID_EXTENSIONS. This affected, for example, the
+     root certificate that some antivirus products install for HTTPS
+     scanning. Reported by CodingMarkus. Fixes #10253.

ChangeLog.d/x509write-set-validity-check.txt

@@ -0,0 +1,7 @@
+Bugfix
+   * mbedtls_x509write_crt_set_validity() only checked the length of the
+     not_before and not_after strings, so timestamps with non-digit
+     characters or out-of-range fields were written into the certificate
+     as is, and a year before 1950 was written as a UTCTime that reads
+     back as a year in 2000-2049. Such timestamps are now rejected with
+     MBEDTLS_ERR_X509_BAD_INPUT_DATA.

include/mbedtls/x509_crt.h

@@ -975,7 +975,9 @@ int mbedtls_x509write_crt_set_serial_raw(mbedtls_x509write_cert *ctx,
  * \param not_after     not_after timestamp
  *
  * \return          0 if timestamp was parsed successfully, or
- *                  a specific error code
+ *                  #MBEDTLS_ERR_X509_BAD_INPUT_DATA if a timestamp is not
+ *                  a valid date and time in the above format, or if its
+ *                  year is before 1950.
  */
 int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx, const char *not_before,
                                        const char *not_after);

library/ssl_tls12_client.c

@@ -2217,7 +2217,7 @@ static int ssl_parse_certificate_request(mbedtls_ssl_context *ssl)
     buf = ssl->in_msg;
 
     /* certificate_types */
-    if (ssl->in_hslen <= mbedtls_ssl_hs_hdr_len(ssl)) {
+    if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 1) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate request message"));
         mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -2227,16 +2227,10 @@ static int ssl_parse_certificate_request(mbedtls_ssl_context *ssl)
     n = cert_type_len;
 
     /*
-     * In the subsequent code there are two paths that read from buf:
-     *     * the length of the signature algorithms field (if minor version of
-     *       SSL is 3),
-     *     * distinguished name length otherwise.
-     * Both reach at most the index:
-     *    ...hdr_len + 2 + n,
-     * therefore the buffer length at this point must be greater than that
-     * regardless of the actual code path.
+     * The two-byte supported_signature_algorithms length is read next,
+     * at offset ...hdr_len + 1 + n.
      */
-    if (ssl->in_hslen <= mbedtls_ssl_hs_hdr_len(ssl) + 2 + n) {
+    if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 1 + n + 2) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate request message"));
         mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -2247,18 +2241,13 @@ static int ssl_parse_certificate_request(mbedtls_ssl_context *ssl)
     sig_alg_len = MBEDTLS_GET_UINT16_BE(buf, mbedtls_ssl_hs_hdr_len(ssl) + 1 + n);
 
     /*
-     * The furthest access in buf is in the loop few lines below:
-     *     sig_alg[i + 1],
-     * where:
-     *     sig_alg = buf + ...hdr_len + 3 + n,
-     *     max(i) = sig_alg_len - 1.
-     * Therefore the furthest access is:
-     *     buf[...hdr_len + 3 + n + sig_alg_len - 1 + 1],
-     * which reduces to:
-     *     buf[...hdr_len + 3 + n + sig_alg_len],
-     * which is one less than we need the buf to be.
+     * The list is a sequence of two-byte values, so its length must be
+     * even. The message must have room for the list itself, plus the
+     * two-byte certificate_authorities length that follows it and is
+     * read below.
      */
-    if (ssl->in_hslen <= mbedtls_ssl_hs_hdr_len(ssl) + 3 + n + sig_alg_len) {
+    if (sig_alg_len % 2 != 0 ||
+        ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 1 + n + 2 + sig_alg_len + 2) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate request message"));
         mbedtls_ssl_send_alert_message(
             ssl,

library/ssl_tls12_server.c

@@ -1016,7 +1016,7 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
     sess_len = buf[34];
 
     if (sess_len > sizeof(ssl->session_negotiate->id) ||
-        sess_len + 34 + 2 > msg_len) { /* 2 for cipherlist length field */
+        sess_len + 35 > msg_len) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
         mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -1037,9 +1037,16 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
         cookie_offset = 35 + sess_len;
+
+        if (cookie_offset + 1 > msg_len) {
+            MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
+            mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                           MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
+            return MBEDTLS_ERR_SSL_DECODE_ERROR;
+        }
         cookie_len = buf[cookie_offset];
 
-        if (cookie_offset + 1 + cookie_len + 2 > msg_len) {
+        if (cookie_offset + 1 + cookie_len > msg_len) {
             MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
             mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                            MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -1085,6 +1092,16 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
     ciph_offset = 35 + sess_len;
 
+    /* The two-byte ciphersuite list length field must be within the
+     * message: the checks above only guarantee that the fields before it
+     * (session id, and for DTLS the cookie) are. */
+    if (ciph_offset + 2 > msg_len) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
+        mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                       MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
+        return MBEDTLS_ERR_SSL_DECODE_ERROR;
+    }
+
     ciph_len = MBEDTLS_GET_UINT16_BE(buf, ciph_offset);
 
     if (ciph_len < 2 ||

library/ssl_tls13_keys.c

@@ -1034,6 +1034,8 @@ int mbedtls_ssl_tls13_populate_transform(
                                      &transform->psa_key_dec)) != PSA_SUCCESS) {
             MBEDTLS_SSL_DEBUG_RET(
                 1, "psa_import_key", PSA_TO_MBEDTLS_ERR(status));
+            psa_destroy_key(transform->psa_key_enc);
+            transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
             return PSA_TO_MBEDTLS_ERR(status);
         }
     }

library/x509_crt.c

@@ -640,6 +640,11 @@ static int x509_get_authority_key_id(unsigned char **p,
                                  MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
     }
 
+    /* All fields are OPTIONAL, so an empty SEQUENCE is valid. */
+    if (*p == end) {
+        return 0;
+    }
+
     ret = mbedtls_asn1_get_tag(p, end, &len,
                                MBEDTLS_ASN1_CONTEXT_SPECIFIC);
 

library/x509write_crt.c

@@ -105,12 +105,60 @@ int mbedtls_x509write_crt_set_serial_raw(mbedtls_x509write_cert *ctx,
     return 0;
 }
 
+/*
+ * Check that a timestamp is a valid date and time in the format
+ * "YYYYMMDDhhmmss" that x509_write_time() can encode.
+ */
+static int x509_write_check_time(const char *t)
+{
+    static const unsigned char days_in_month[12] =
+    { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
+    /* century, year in century, month, day, hour, minute, second */
+    unsigned int field[7];
+    unsigned int year, mon, month_days;
+
+    if (strlen(t) != MBEDTLS_X509_RFC5280_UTC_TIME_LEN - 1) {
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
+    }
+
+    for (size_t i = 0; i < 7; i++) {
+        unsigned int d1 = (unsigned int) ((unsigned char) t[2 * i] - '0');
+        unsigned int d2 = (unsigned int) ((unsigned char) t[2 * i + 1] - '0');
+        if (d1 > 9 || d2 > 9) {
+            return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
+        }
+        field[i] = d1 * 10 + d2;
+    }
+
+    year = field[0] * 100 + field[1];
+    mon = field[2];
+
+    /* Years before 2050 are written as UTCTime, which cannot represent
+     * a year before 1950: it would be read back as 20YY (RFC 5280
+     * section 4.1.2.5.1). */
+    if (year < 1950 || mon < 1 || mon > 12) {
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
+    }
+
+    month_days = days_in_month[mon - 1];
+    if (mon == 2 && year % 4 == 0 && (year % 100 != 0 || year % 400 == 0)) {
+        month_days = 29;
+    }
+
+    if (field[3] < 1 || field[3] > month_days ||
+        field[4] > 23 || field[5] > 59 || field[6] > 59) {
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
+    }
+
+    return 0;
+}
+
 int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx,
                                        const char *not_before,
                                        const char *not_after)
 {
-    if (strlen(not_before) != MBEDTLS_X509_RFC5280_UTC_TIME_LEN - 1 ||
-        strlen(not_after)  != MBEDTLS_X509_RFC5280_UTC_TIME_LEN - 1) {
+    if (x509_write_check_time(not_before) != 0 ||
+        x509_write_check_time(not_after) != 0) {
         return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
     }
     strncpy(ctx->not_before, not_before, MBEDTLS_X509_RFC5280_UTC_TIME_LEN);

tests/CMakeLists.txt

@@ -66,7 +66,9 @@ if(GEN_FILES)
     add_custom_target(handshake-generated.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/handshake-generated.sh)
     set_target_properties(handshake-generated.sh PROPERTIES EXCLUDE_FROM_ALL NO)
+if(ENABLE_PROGRAMS)
     add_dependencies(${ssl_opt_target} handshake-generated.sh)
+endif()
 
     add_custom_command(
         OUTPUT
@@ -79,10 +81,12 @@ if(GEN_FILES)
         DEPENDS
             ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_tls13_compat_tests.py
     )
+if(ENABLE_PROGRAMS)
     add_custom_target(tls13-compat.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/tls13-compat.sh)
     set_target_properties(tls13-compat.sh PROPERTIES EXCLUDE_FROM_ALL NO)
     add_dependencies(${ssl_opt_target} tls13-compat.sh)
+endif()
 
 else()
     foreach(file ${all_generated_data_files})

tests/suites/test_suite_ssl.data

@@ -2856,6 +2856,9 @@ SSL TLS 1.3 Record Encryption RFC 8448 Example #2
 depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_WANT_ALG_SHA_256
 ssl_tls13_record_protection:MBEDTLS_TLS1_3_AES_128_GCM_SHA256:MBEDTLS_SSL_IS_SERVER:1:1:"9f02283b6c9c07efc26bb9f2ac92e356":"cf782b88dd83549aadf1e984":"17422dda596ed5d9acd890e3c63f5051":"5b78923dee08579033e523d9":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031":"2e937e11ef4ac740e538ad36005fc4a46932fc3225d05f82aa1b36e30efaf97d90e6dffc602dcb501a59a8fcc49c4bf2e5f0a21c0047c2abf332540dd032e167c2955d"
 
+TLS 1.3 transform frees encryption key if decryption key import fails
+ssl_tls13_populate_transform_second_key_import_failure
+
 SSL TLS 1.3 Key schedule: Application secrets derivation helper
 # Vector from RFC 8448
 depends_on:PSA_WANT_ALG_SHA_256

tests/suites/test_suite_ssl.function

@@ -8,6 +8,7 @@
 #endif /* MBEDTLS_PK_HAVE_PRIVATE_HEADER */
 #include <ssl_tls13_keys.h>
 #include <ssl_tls13_invasive.h>
+#include <psa_crypto_slot_management.h>
 #include <test/ssl_helpers.h>
 #include <test/ssl_helpers_internal.h>
 
@@ -36,6 +37,35 @@
 #define TEST_SSL_CONTEXT_LOAD_OOB_IN_CID   0
 #define TEST_SSL_CONTEXT_LOAD_OOB_OUT_CID  1
 #define TEST_SSL_CONTEXT_LOAD_OOB_ALPN     2
+#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC)
+#if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_SSL_CLI_C) && \
+    defined(MBEDTLS_PSA_CRYPTO_C)
+#define SSL_TEST_KEY_SLICE_1_LENGTH 4
+#define SSL_TEST_KEY_SLICE_2_LENGTH 10
+static size_t ssl_test_tiny_key_slice_length(size_t slice_idx)
+{
+    switch (slice_idx) {
+        case 1: return SSL_TEST_KEY_SLICE_1_LENGTH;
+        case 2: return SSL_TEST_KEY_SLICE_2_LENGTH;
+        default: return 1;
+    }
+}
+
+/* In the below definition SSL_TEST_KEY_SLICE_1_LENGTH has 4 slots and
+ * SSL_TEST_KEY_SLICE_2_LENGTH has 10 all other slices have 1.
+ * psa_key_slot_volatile_slice_count() returns the total number of slices.
+ * However we have already countes slices 1 and 2, so we mustr subtract 2 from
+ * this number to avoid double counting.
+ */
+
+#define SSL_TEST_MAX_VOLATILE_KEYS                         \
+    (SSL_TEST_KEY_SLICE_1_LENGTH +                         \
+     SSL_TEST_KEY_SLICE_2_LENGTH +                         \
+     psa_key_slot_volatile_slice_count() - 2)
+#endif /* MBEDTLS_TEST_HOOKS && MBEDTLS_SSL_CLI_C */
+#else /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
+#define SSL_TEST_MAX_VOLATILE_KEYS MBEDTLS_PSA_KEY_SLOT_COUNT
+#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
     defined(MBEDTLS_SSL_SESSION_TICKETS) && \
@@ -2489,6 +2519,85 @@ exit:
 }
 /* END_CASE */
 
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:SSL_TEST_MAX_VOLATILE_KEYS:MBEDTLS_PSA_CRYPTO_C */
+void ssl_tls13_populate_transform_second_key_import_failure(void)
+{
+    mbedtls_ssl_key_set traffic_keys;
+    mbedtls_ssl_transform transform;
+    mbedtls_svc_key_id_t *keys = NULL;
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    mbedtls_psa_stats_t stats_before, stats_after;
+    psa_status_t status = PSA_SUCCESS;
+    size_t i = 0;
+
+    memset(&traffic_keys, 0, sizeof(traffic_keys));
+    mbedtls_ssl_transform_init(&transform);
+
+#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) && defined(MBEDTLS_TEST_HOOKS)
+    mbedtls_test_hook_psa_volatile_key_slice_length =
+        ssl_test_tiny_key_slice_length;
+#endif
+
+    PSA_INIT();
+    TEST_CALLOC(keys, SSL_TEST_MAX_VOLATILE_KEYS + 1);
+
+    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT);
+    psa_set_key_type(&attributes, PSA_KEY_TYPE_RAW_DATA);
+
+    /* Allow one more attempt than the maximum number of volatile keys so
+     * that the loop ends because the key store is full. */
+    while (i <= SSL_TEST_MAX_VOLATILE_KEYS) {
+        status = psa_import_key(&attributes,
+                                (const uint8_t *) &i, sizeof(i),
+                                &keys[i]);
+        if (status == PSA_ERROR_INSUFFICIENT_MEMORY) {
+            break;
+        }
+        PSA_ASSERT(status);
+        i++;
+    }
+    TEST_EQUAL(status, PSA_ERROR_INSUFFICIENT_MEMORY);
+    TEST_ASSERT(i > 0);
+
+    /* Leave exactly one slot free: the encryption key import consumes it,
+     * then the decryption key import fails. */
+    PSA_ASSERT(psa_destroy_key(keys[--i]));
+    keys[i] = MBEDTLS_SVC_KEY_ID_INIT;
+    mbedtls_psa_get_stats(&stats_before);
+
+    traffic_keys.key_len = 16;
+    traffic_keys.iv_len = 12;
+    TEST_ASSERT(mbedtls_ssl_tls13_populate_transform(
+                    &transform, MBEDTLS_SSL_IS_CLIENT,
+                    MBEDTLS_TLS1_3_AES_128_GCM_SHA256,
+                    &traffic_keys, NULL) != 0);
+
+    /* The first import must be rolled back when the second one fails. */
+    TEST_ASSERT(mbedtls_svc_key_id_is_null(transform.psa_key_enc));
+
+    /* Also check the key store itself: the failed operation must neither
+     * consume a slot nor leave the only free slot unusable. */
+    mbedtls_psa_get_stats(&stats_after);
+    TEST_EQUAL(stats_after.volatile_slots, stats_before.volatile_slots);
+    TEST_EQUAL(stats_after.empty_slots, stats_before.empty_slots);
+    PSA_ASSERT(psa_import_key(&attributes,
+                              (const uint8_t *) &i, sizeof(i),
+                              &keys[i]));
+    i++;
+
+exit:
+    mbedtls_ssl_transform_free(&transform);
+    while (i > 0) {
+        psa_destroy_key(keys[--i]);
+    }
+    mbedtls_free(keys);
+    PSA_DONE();
+#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) && defined(MBEDTLS_TEST_HOOKS)
+    mbedtls_test_hook_psa_volatile_key_slice_length = NULL;
+#endif
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */
 void ssl_tls13_key_evolution(int hash_alg,
                              data_t *secret,

tests/suites/test_suite_ssl.tls-defrag.data

@@ -63,6 +63,26 @@ Inject ClientHello - TLS 1.2 unknown ciphersuite (for reference)
 depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_GCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1
 inject_client_content_on_the_wire:MBEDTLS_PK_ECDSA:MBEDTLS_SSL_CLIENT_HELLO:"160303002f0100002b03030123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef000002cccc01000000":"got no ciphersuites in common":MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE
 
+# See "ClientHello breakdown" above
+# ClientHello body ending right after the session id: version (2) +
+# random (32) + session id length (1) + session id (3) = 38 bytes, the
+# minimum accepted, with the ciphersuite list length field missing
+# entirely. Only run in TLS 1.2-only builds: when TLS 1.3 is enabled,
+# the TLS 1.3 code parses the ClientHello first and rejects it itself.
+Inject ClientHello - TLS 1.2 truncated after session id
+depends_on:MBEDTLS_SSL_PROTO_TLS1_2:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_GCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1
+inject_client_content_on_the_wire:MBEDTLS_PK_ECDSA:MBEDTLS_SSL_CLIENT_HELLO:"160303002a0100002603030123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef035f5f5f":"bad client hello message":MBEDTLS_ERR_SSL_DECODE_ERROR
+
+# See "ClientHello breakdown" above
+# ClientHello body ending inside the ciphersuite list length: version (2) +
+# random (32) + session id length (1) + session id (2) + first length
+# byte (1) = 38 bytes. Reading the full two-byte length field used to
+# over-read one byte past the end of the message.
+# Only run in TLS 1.2-only builds, see above.
+Inject ClientHello - TLS 1.2 truncated inside ciphersuite list length
+depends_on:MBEDTLS_SSL_PROTO_TLS1_2:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_GCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1
+inject_client_content_on_the_wire:MBEDTLS_PK_ECDSA:MBEDTLS_SSL_CLIENT_HELLO:"160303002a0100002603030123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef025f5f00":"bad client hello message":MBEDTLS_ERR_SSL_DECODE_ERROR
+
 # See "ClientHello breakdown" above
 # ephemeral with secp256r1 + MBEDTLS_TLS1_3_AES_128_GCM_SHA256
 Inject ClientHello - TLS 1.3 good (for reference)

tests/suites/test_suite_x509parse.data

@@ -3487,6 +3487,30 @@ X509 CRT parse Authority Key Id - Wrong Issuer sequence
 depends_on:PSA_WANT_ALG_MD5:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 x509_crt_parse_authoritykeyid:"../framework/data_files/clusterfuzz-testcase-minimized-fuzz_x509crt-6666050834661376.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA)
 
+# Self-signed certificate whose AuthorityKeyIdentifier is an empty SEQUENCE (30 00).
+# All fields of AuthorityKeyIdentifier are OPTIONAL in the ASN.1 module (RFC 5280,
+# Appendix A.2), so this is syntactically valid; some antivirus products install
+# such a root for HTTPS scanning. Generated with Python cryptography:
+#   key = ec.generate_private_key(ec.SECP256R1())
+#   name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "Test")])
+#   cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name)
+#           .public_key(key.public_key()).serial_number(1)
+#           .not_valid_before(datetime.datetime(2025, 1, 1))
+#           .not_valid_after(datetime.datetime(2035, 1, 1))
+#           .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+#           .add_extension(x509.UnrecognizedExtension(ObjectIdentifier("2.5.29.35"),
+#                                                     b"\x30\x00"), critical=False)
+#           .sign(key, hashes.SHA256()))
+X509 CRT parse Authority Key Id - Empty sequence
+depends_on:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+x509parse_crt:"3082012b3081d1a003020102020101300a06082a8648ce3d040302300f310d300b06035504030c0454657374301e170d3235303130313030303030305a170d3335303130313030303030305a300f310d300b06035504030c04546573743059301306072a8648ce3d020106082a8648ce3d03010703420004f8cf6bd9eb57f5fdc8771103e9f75becb6a865b1a5de8492b3233170f49e1ff388d25d24376d130c86a8acb5b0478d7c49b83f07ffbd0684c26a0da42c752256a31e301c300f0603551d130101ff040530030101ff30090603551d2304023000300a06082a8648ce3d0403020349003046022100cffb50bdb73287649de96d4c48fcbb5d6e1eb468c72c5016776a9fdf0dc3d295022100e1b4b7ecba9ca1b43882a688c6fd93ffc99112247cf3ebb852b07f09d7c76be2":"cert. version     \: 3\nserial number     \: 01\nissuer name       \: CN=Test\nsubject name      \: CN=Test\nissued  on        \: 2025-01-01 00\:00\:00\nexpires on        \: 2035-01-01 00\:00\:00\nsigned using      \: ECDSA with SHA256\nEC key size       \: 256 bits\nbasic constraints \: CA=true\n":0
+
+# Generated the same way as above, with extension value b"\x30\x01\x80":
+# a [0] tag without a length. This must still be rejected.
+X509 CRT parse Authority Key Id - Truncated keyIdentifier
+depends_on:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+x509parse_crt:"3082012b3081d2a003020102020101300a06082a8648ce3d040302300f310d300b06035504030c0454657374301e170d3235303130313030303030305a170d3335303130313030303030305a300f310d300b06035504030c04546573743059301306072a8648ce3d020106082a8648ce3d03010703420004eba1e439f91038837190c4da3703001dff24411b90bf6998f56cba76c753c19ca9158f3c243ccb2118f8b6a78b6eb507962e855bf7c13dbafc314dc56d5d27d8a31f301d300f0603551d130101ff040530030101ff300a0603551d230403300180300a06082a8648ce3d040302034800304502205443c61342f55d3d4cec26df92b7614a5e67177f057efd4f6fb9d7a1a47f5d110221008f05c4c193e203d78a322455132f1b4428388904874dd329fc60a68a37a559b4":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA)
+
 OID get numeric string - hardware module name
 oid_get_numeric_string:"2B06010505070804":0:"1.3.6.1.5.5.7.8.4"
 

tests/suites/test_suite_x509write.data

@@ -287,6 +287,60 @@ mbedtls_x509_string_to_names:"C=NL, 2.5.4.10.234.532=#0C084F6666737061726B, OU=P
 Check max serial length
 x509_set_serial_check:
 
+Set validity: valid, UTCTime range
+x509_set_validity_check:"20190210144406":"20290210144406":0
+
+Set validity: valid, GeneralizedTime range
+x509_set_validity_check:"20500101000000":"99991231235959":0
+
+Set validity: valid, first year representable as UTCTime
+x509_set_validity_check:"19500101000000":"20490101000000":0
+
+Set validity: valid, 29 February in a leap year
+x509_set_validity_check:"20240229000000":"20280229235959":0
+
+Set validity: too short
+x509_set_validity_check:"2019021014440":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: too long
+x509_set_validity_check:"20190210144406":"202902101444060":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: non-digit in not_before
+x509_set_validity_check:"2019021014440Z":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: non-digit in not_after
+x509_set_validity_check:"20190210144406":"2029-02-10 14h":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: month 00
+x509_set_validity_check:"20190010144406":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: month 13
+x509_set_validity_check:"20191310144406":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: day 00
+x509_set_validity_check:"20190200144406":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: 31 April
+x509_set_validity_check:"20190431144406":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: 29 February in a non-leap year
+x509_set_validity_check:"20190229144406":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: 29 February 2100 (not a leap year)
+x509_set_validity_check:"20190210144406":"21000229000000":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: hour 24
+x509_set_validity_check:"20190210244406":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: minute 60
+x509_set_validity_check:"20190210146006":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: second 60
+x509_set_validity_check:"20190210144460":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
+Set validity: year before 1950 cannot be encoded as UTCTime
+x509_set_validity_check:"19491231235959":"20290210144406":MBEDTLS_ERR_X509_BAD_INPUT_DATA
+
 Check max extension length
 x509_set_extension_length_check:
 

tests/suites/test_suite_x509write.function

@@ -579,6 +579,23 @@ exit:
 }
 /* END_CASE */
 
+/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_WRITE_C */
+void x509_set_validity_check(char *not_before, char *not_after, int expected_ret)
+{
+    mbedtls_x509write_cert ctx;
+
+    USE_PSA_INIT();
+    mbedtls_x509write_crt_init(&ctx);
+
+    TEST_EQUAL(mbedtls_x509write_crt_set_validity(&ctx, not_before, not_after),
+               expected_ret);
+
+exit:
+    mbedtls_x509write_crt_free(&ctx);
+    USE_PSA_DONE();
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:MBEDTLS_X509_CREATE_C:MBEDTLS_X509_USE_C */
 void mbedtls_x509_string_to_names(char *name, char *parsed_name,
                                   int result, int may_fail)