authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-04-20 21:54:04+02:00
committergravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2026-04-20 22:40:17+02:00
log58ea88f6cfbaa7a96236a53e26c86ead1ce7c9c2
tree140c120a77fe258e2735b3066e95ac330447b131
parentaeff0efafc1f6a57251a28ad754fc7cf050fa895
signaturebadge-check Signed by SSH key SHA256:7B/LJ7bpR1eX8aCXSr4mtd5M45VMPKcx9zY8e95b5QM

crypto.asn1.Oid: Reject empty OID encodings (#31983)

The DER decoder accepted zero-length OID payloads producing an Oid value that would panic later. Co-authored-by: Frank Denis <github@pureftpd.org> Reviewed-on: https://codeberg.org/ziglang/zig/pulls/31983 Reviewed-by: Andrew Kelley <andrew@ziglang.org> Co-authored-by: Frank Denis <jedisct1@noreply.codeberg.org> Co-committed-by: Frank Denis <jedisct1@noreply.codeberg.org>

1 files changed, 12 insertions(+), 1 deletions(-)

lib/std/crypto/codecs/asn1/Oid.zig+12-1
...@@ -85,6 +85,14 @@ test toDot {...@@ -85,6 +85,14 @@ test toDot {
85 }85 }
86}86}
8787
88test "malformed OID" {
89 var empty: der.Decoder = .{ .bytes = &.{ 0x06, 0x00 } };
90 try std.testing.expectError(error.EndOfStream, decodeDer(&empty));
91
92 var truncated: der.Decoder = .{ .bytes = &.{ 0x06, 0x02, 0x2a, 0x80 } };
93 try std.testing.expectError(error.InvalidEncoding, decodeDer(&truncated));
94}
95
88const TestCase = struct {96const TestCase = struct {
89 encoded: []const u8,97 encoded: []const u8,
90 dot_notation: []const u8,98 dot_notation: []const u8,
...@@ -109,7 +117,10 @@ pub const asn1_tag = asn1.Tag.init(.oid, false, .universal);...@@ -109,7 +117,10 @@ pub const asn1_tag = asn1.Tag.init(.oid, false, .universal);
109117
110pub fn decodeDer(decoder: *der.Decoder) !Oid {118pub fn decodeDer(decoder: *der.Decoder) !Oid {
111 const ele = try decoder.element(asn1_tag.toExpected());119 const ele = try decoder.element(asn1_tag.toExpected());
112 return Oid{ .encoded = decoder.view(ele) };120 const encoded = decoder.view(ele);
121 if (encoded.len == 0) return error.EndOfStream;
122 if (encoded[encoded.len - 1] & 0x80 != 0) return error.InvalidEncoding;
123 return Oid{ .encoded = encoded };
113}124}
114125
115pub fn encodeDer(self: Oid, encoder: *der.Encoder) !void {126pub fn encodeDer(self: Oid, encoder: *der.Encoder) !void {