From 957f269a4259207400f7bac9bd8a200c1c5a53d7 Mon Sep 17 00:00:00 2001 From: DraagrenKirneh Date: Mon, 22 May 2023 16:13:34 +0200 Subject: [PATCH] Ignore certificates with unknown OID (#15539) * Ignore certificates with unknown OID * switch directly after catch --- lib/std/crypto/Certificate/Bundle.zig | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/std/crypto/Certificate/Bundle.zig b/lib/std/crypto/Certificate/Bundle.zig index b3b5409d277119810c915c981cf92a43328492d0..fe1ef4c0c37d112a9f9bf4b31b7d41b848481128 100644 --- a/lib/std/crypto/Certificate/Bundle.zig +++ b/lib/std/crypto/Certificate/Bundle.zig @@ -244,10 +244,16 @@ pub fn parseCert(cb: *Bundle, gpa: Allocator, decoded_start: u32, now_sec: i64) // the subject name, we pre-parse all of them to make sure and only // include in the bundle ones that we know will parse. This way we can // use `catch unreachable` later. - const parsed_cert = try Certificate.parse(.{ + const parsed_cert = Certificate.parse(.{ .buffer = cb.bytes.items, .index = decoded_start, - }); + }) catch |err| switch (err) { + error.CertificateHasUnrecognizedObjectId => { + cb.bytes.items.len = decoded_start; + return; + }, + else => |e| return e, + }; if (now_sec > parsed_cert.validity.not_after) { // Ignore expired cert. cb.bytes.items.len = decoded_start; -- 2.54.0