Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-25 19:47:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove unreachable CSR extensionRequest check

Browse Source 
It is now unreachable because:

- end_set == end_attr_data is enforced at library/x509_csr.c:236.
- end_exts == end_set is enforced at library/x509_csr.c:248.
- x509_csr_parse_extensions() only returns success if *p == end_exts, enforced
  at library/x509_csr.c:188.

So after a successful x509_csr_parse_extensions() call, *p == end_exts ==
end_set == end_attr_data. The condition at line 257 cannot be true.

Signed-off-by: Gilles Peskine <[email protected]>
This commit is contained in:
Gilles Peskine
2026-06-05 11:34:22 +02:00
parent 44b833324b
commit ef81e71061
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/x509_csr.c
+2 -5
View File
@@ -253,11 +253,8 @@ static int x509_csr_parse_attributes(mbedtls_x509_csr *csr,
if ((ret = x509_csr_parse_extensions(csr, p, end_exts, cb, p_ctx)) != 0) { if ((ret = x509_csr_parse_extensions(csr, p, end_exts, cb, p_ctx)) != 0) {
return ret; return ret;
} }
/* x509_csr_parse_extensions() guarantees *p == end_exts
if (*p != end_attr_data) { * on success */
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
}
} }
*p = end_attr_data; *p = end_attr_data;