Source code
Revision control
Copy as Markdown
Other Tools
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
#include <stdint.h>
#include "gtest/gtest.h"
#include "scoped_ptrs_util.h"
#include "nss.h"
#include "prerror.h"
#include "secasn1.h"
#include "secder.h"
#include "secerr.h"
#include "secitem.h"
namespace nss_test {
struct TemplateAndInput {
const SEC_ASN1Template* t;
SECItem input;
};
class QuickDERTest : public ::testing::Test,
public ::testing::WithParamInterface<TemplateAndInput> {};
static const uint8_t kBitstringTag = 0x03;
static const uint8_t kNullTag = 0x05;
static const uint8_t kLongLength = 0x80;
const SEC_ASN1Template kBitstringTemplate[] = {
{SEC_ASN1_BIT_STRING, 0, NULL, sizeof(SECItem)}, {0}};
// Empty bitstring with unused bits.
static uint8_t kEmptyBitstringUnused[] = {kBitstringTag, 1, 1};
// Bitstring with 8 unused bits.
static uint8_t kBitstring8Unused[] = {kBitstringTag, 3, 8, 0xff, 0x00};
// Bitstring with >8 unused bits.
static uint8_t kBitstring9Unused[] = {kBitstringTag, 3, 9, 0xff, 0x80};
const SEC_ASN1Template kNullTemplate[] = {
{SEC_ASN1_NULL, 0, NULL, sizeof(SECItem)}, {0}};
// Length of zero wrongly encoded as 0x80 instead of 0x00.
static uint8_t kOverlongLength_0_0[] = {kNullTag, kLongLength | 0};
// Length of zero wrongly encoded as { 0x81, 0x00 } instead of 0x00.
static uint8_t kOverlongLength_1_0[] = {kNullTag, kLongLength | 1, 0x00};
// Length of zero wrongly encoded as:
//
// { 0x90, <arbitrary junk of 12 bytes>,
// 0x00, 0x00, 0x00, 0x00 }
//
// instead of 0x00. Note in particular that if there is an integer overflow
// then the arbitrary junk is likely get left-shifted away, as long as there
// are at least sizeof(length) bytes following it. This would be a good way to
// smuggle arbitrary input into DER-encoded data in a way that an non-careful
// parser would ignore.
static uint8_t kOverlongLength_16_0[] = {kNullTag, kLongLength | 0x10,
0x11, 0x22,
0x33, 0x44,
0x55, 0x66,
0x77, 0x88,
0x99, 0xAA,
0xBB, 0xCC,
0x00, 0x00,
0x00, 0x00};
#define TI(t, x) \
{ \
t, { siBuffer, x, sizeof(x) } \
}
static const TemplateAndInput kInvalidDER[] = {
TI(kBitstringTemplate, kEmptyBitstringUnused),
TI(kBitstringTemplate, kBitstring8Unused),
TI(kBitstringTemplate, kBitstring9Unused),
TI(kNullTemplate, kOverlongLength_0_0),
TI(kNullTemplate, kOverlongLength_1_0),
TI(kNullTemplate, kOverlongLength_16_0),
};
#undef TI
TEST_P(QuickDERTest, InvalidLengths) {
const SECItem& original_input(GetParam().input);
ScopedSECItem copy_of_input(SECITEM_AllocItem(nullptr, nullptr, 0U));
ASSERT_TRUE(copy_of_input);
ASSERT_EQ(SECSuccess,
SECITEM_CopyItem(nullptr, copy_of_input.get(), &original_input));
PORTCheapArenaPool pool;
PORT_InitCheapArena(&pool, DER_DEFAULT_CHUNKSIZE);
StackSECItem parsed_value;
ASSERT_EQ(SECFailure,
SEC_QuickDERDecodeItem(&pool.arena, &parsed_value, GetParam().t,
copy_of_input.get()));
ASSERT_EQ(SEC_ERROR_BAD_DER, PR_GetError());
PORT_DestroyCheapArena(&pool);
}
INSTANTIATE_TEST_SUITE_P(QuickderTestsInvalidLengths, QuickDERTest,
testing::ValuesIn(kInvalidDER));
const SEC_ASN1Template kOctetStringTemplate[] = {
{SEC_ASN1_OCTET_STRING, 0, NULL, sizeof(SECItem)}, {0}};
TEST_F(QuickDERTest, DefaultLimitRejectsOversizedInput) {
PORTCheapArenaPool pool;
PORT_InitCheapArena(&pool, DER_DEFAULT_CHUNKSIZE);
SECItem dest = {siBuffer, nullptr, 0};
// Construct a SECItem whose len exceeds the default limit without allocating
// a real buffer of that size — the check fires before any data access.
uint8_t dummy = 0x04;
SECItem oversized = {siBuffer, &dummy,
static_cast<unsigned int>(SEC_ASN1D_MAX_INPUT_SIZE) + 1};
ASSERT_EQ(SECFailure,
SEC_QuickDERDecodeItem(&pool.arena, &dest, kOctetStringTemplate,
&oversized));
ASSERT_EQ(SEC_ERROR_BAD_DER, PR_GetError());
PORT_DestroyCheapArena(&pool);
}
TEST_F(QuickDERTest, ExactLimitAccepted) {
// A well-formed 11-byte OCTET STRING is accepted under the default limit.
// clang-format off
static uint8_t kInput[] = {0x04, 0x09,
0x01, 0x02, 0x03, 0x04, 0x05,
0x06, 0x07, 0x08, 0x09};
// clang-format on
PORTCheapArenaPool pool;
PORT_InitCheapArena(&pool, DER_DEFAULT_CHUNKSIZE);
SECItem dest = {siBuffer, nullptr, 0};
SECItem src = {siBuffer, kInput, sizeof(kInput)};
ASSERT_EQ(SECSuccess, SEC_QuickDERDecodeItem(&pool.arena, &dest,
kOctetStringTemplate, &src));
PORT_DestroyCheapArena(&pool);
}
TEST_F(QuickDERTest, CustomLimitsCanBypassDefaultSizeLimit) {
// SEC_QuickDERDecodeItemWithLimits with max_input_size=0 skips the size
// check. Use a valid zero-length OCTET STRING but declare the SECItem
// length as larger than SEC_ASN1D_MAX_INPUT_SIZE.
static uint8_t kZeroOctetString[] = {0x04, 0x00};
PORTCheapArenaPool pool;
PORT_InitCheapArena(&pool, DER_DEFAULT_CHUNKSIZE);
SECItem dest = {siBuffer, nullptr, 0};
SECItem oversized = {siBuffer, kZeroOctetString,
static_cast<unsigned int>(SEC_ASN1D_MAX_INPUT_SIZE) + 1};
SECStatus rv = SEC_QuickDERDecodeItemWithLimits(
&pool.arena, &dest, kOctetStringTemplate, &oversized, 0, 0);
ASSERT_EQ(rv, SECFailure);
ASSERT_NE(PR_GetError(), SEC_ERROR_BAD_DER);
PORT_DestroyCheapArena(&pool);
}
TEST_F(QuickDERTest, CustomLimitsEnforcesInputSize) {
static uint8_t kZeroOctetString[] = {0x04, 0x00};
PORTCheapArenaPool pool;
PORT_InitCheapArena(&pool, DER_DEFAULT_CHUNKSIZE);
SECItem dest = {siBuffer, nullptr, 0};
SECItem src = {siBuffer, kZeroOctetString, sizeof(kZeroOctetString)};
SECStatus rv = SEC_QuickDERDecodeItemWithLimits(
&pool.arena, &dest, kOctetStringTemplate, &src, 1, 0);
ASSERT_EQ(rv, SECFailure);
ASSERT_EQ(PR_GetError(), SEC_ERROR_BAD_DER);
PORT_DestroyCheapArena(&pool);
}
} // namespace nss_test