authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-04-20 21:54:04+02:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2026-04-20 21:54:04+02:00
log98cc059622cd5cad3eef1bbc851437358d259033
treefc0cf75579ed2e6f5fdfd67de9b7d2c435772691
parent98ddebc380fd12b91c00b90c049435117d03274b

crypto.asn1.Oid: Reject empty OID encodings (#31983)

The DER decoder accepted zero-length OID payloads producing an Oid value that would panic later. Co-authored-by: Frank Denis <github@pureftpd.org> Reviewed-on: https://codeberg.org/ziglang/zig/pulls/31983 Reviewed-by: Andrew Kelley <andrew@ziglang.org> Co-authored-by: Frank Denis <jedisct1@noreply.codeberg.org> Co-committed-by: Frank Denis <jedisct1@noreply.codeberg.org>

1 files changed, 12 insertions(+), 1 deletions(-)

lib/std/crypto/codecs/asn1/Oid.zig+12-1
......@@ -85,6 +85,14 @@ test toDot {
8585 }
8686}
8787
88test "malformed OID" {
89 var empty: der.Decoder = .{ .bytes = &.{ 0x06, 0x00 } };
90 try std.testing.expectError(error.EndOfStream, decodeDer(&empty));
91
92 var truncated: der.Decoder = .{ .bytes = &.{ 0x06, 0x02, 0x2a, 0x80 } };
93 try std.testing.expectError(error.InvalidEncoding, decodeDer(&truncated));
94}
95
8896const TestCase = struct {
8997 encoded: []const u8,
9098 dot_notation: []const u8,
......@@ -109,7 +117,10 @@ pub const asn1_tag = asn1.Tag.init(.oid, false, .universal);
109117
110118pub fn decodeDer(decoder: *der.Decoder) !Oid {
111119 const ele = try decoder.element(asn1_tag.toExpected());
112 return Oid{ .encoded = decoder.view(ele) };
120 const encoded = decoder.view(ele);
121 if (encoded.len == 0) return error.EndOfStream;
122 if (encoded[encoded.len - 1] & 0x80 != 0) return error.InvalidEncoding;
123 return Oid{ .encoded = encoded };
113124}
114125
115126pub fn encodeDer(self: Oid, encoder: *der.Encoder) !void {