commit f149cd1a3a980db39d406ed52e24906f33826ba8
author Paul Elliott <62069445+paul-elliott-arm@users.noreply.github.com> Wed Jan 10 16:57:16 2024 +0000
committer GitHub <noreply@github.com> Wed Jan 10 16:57:16 2024 +0000
tree c629747137e948ab4f72966cbac85853bb86d644
parent 3eb9025275dab98743ca65523ec71a595849d21e
parent 315c3ca9e55f74e58ae4a5be96c2ed890106c0dd

Merge pull request #8688 from jwinzig-at-hilscher/development

Fix bug in mbedtls_x509_set_extension

library/x509_create.c

diff --git a/library/x509_create.c b/library/x509_create.c
index 8f31c3b..f7a17e7 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -382,6 +382,10 @@
 {
     mbedtls_asn1_named_data *cur;
 
+    if (val_len > (SIZE_MAX  - 1)) {
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
+    }
+
     if ((cur = mbedtls_asn1_store_named_data(head, oid, oid_len,
                                              NULL, val_len + 1)) == NULL) {
         return MBEDTLS_ERR_X509_ALLOC_FAILED;

tests/suites/test_suite_x509write.data

diff --git a/tests/suites/test_suite_x509write.data b/tests/suites/test_suite_x509write.data
index 28cef30..5c6a903 100644
--- a/tests/suites/test_suite_x509write.data
+++ b/tests/suites/test_suite_x509write.data
@@ -265,3 +265,6 @@
 
 Check max serial length
 x509_set_serial_check:
+
+Check max extension length
+x509_set_extension_length_check:

tests/suites/test_suite_x509write.function

diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function
index b59fd48..503d976 100644
--- a/tests/suites/test_suite_x509write.function
+++ b/tests/suites/test_suite_x509write.function
@@ -752,3 +752,24 @@
     USE_PSA_DONE();
 }
 /* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_X509_CSR_WRITE_C */
+void x509_set_extension_length_check()
+{
+    int ret = 0;
+
+    mbedtls_x509write_csr ctx;
+    mbedtls_x509write_csr_init(&ctx);
+
+    unsigned char buf[EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH] = { 0 };
+    unsigned char *p = buf + sizeof(buf);
+
+    ret = mbedtls_x509_set_extension(&(ctx.MBEDTLS_PRIVATE(extensions)),
+                                     MBEDTLS_OID_EXTENDED_KEY_USAGE,
+                                     MBEDTLS_OID_SIZE(MBEDTLS_OID_EXTENDED_KEY_USAGE),
+                                     0,
+                                     p,
+                                     SIZE_MAX);
+    TEST_ASSERT(MBEDTLS_ERR_X509_BAD_INPUT_DATA == ret);
+}
+/* END_CASE */