cloudflare / cloudflare/cfssl

Truncated data when parsing DER

Open
#937 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Hi!

When parsing DER-encoded certificates (not just PEM) the data is trimmed, thus potentially truncated:
https://github.com/cloudflare/cfssl/blob/00198453225de901f8e41208f1656aa63dae0642/helpers/helpers.go#L245

DER is binary, though, and in particular I've encountered situations where valid raw x509 certificates would fail to decode (`asn1: syntax error: data truncated`) because the last byte would have been dropped that way.

Am I missing something? Are there situations where this is necessary? Or is this a bug?

Here's a minimal example:

```
package main

import (
"crypto/x509"
"encoding/pem"
"fmt"
"reflect"
"testing"

"github.com/cloudflare/cfssl/helpers"
)

var example = []byte(`-----BEGIN CERTIFICATE-----
MIIB1DCCAXugAwIBAgIUDyYl6S3xfgb0TwV1bYkrwJ/zxAcwCgYIKoZIzj0EAwIw
KDEUMBIGA1UEChMLZXhhbXBsZS5jb20xEDAOBgNVBAMTB1Jvb3QgQ0EwHhcNMTgx
MDIzMTIyOTAwWhcNMTgxMDI0MTIyOTAwWjAbMRkwFwYDVQQDExB0ZXN0LmV4YW1w
bGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQsEmvw8dt+uoq93dulEM
hv+ikUTN64lX6tjVT0rtuv4EJ0sNbWTGF0tjOTQlIjZuHPUrecP3YBOMJqAIupvY
WKOBjzCBjDATBgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1Ud
DgQWBBRgRSJLrZnVulgGwab9klN/4Kf7kTArBgNVHSMEJDAigCBcKTj4GO6Kp7NR
DBoNN7Xry4jfLU1ZTccEvhTMI4LpiDAbBgNVHREEFDASghB0ZXN0LmV4YW1wbGUu
Y29tMAoGCCqGSM49BAMCA0cAMEQCIEW4mPwMOsp7Kk98fWBTG6c8qWJe1uGwg382
qeUvY+sPAiBefpX3oyleotI+8YF1GP2CcuMKVdj33+zIr2acBeukCw==
-----END CERTIFICATE-----
`)

func TestDER(t *testing.T) {
fromPEM, err := helpers.ParseCertificatesPEM(example)
if err != nil {
t.Fatal(err)
}

block, _ := pem.Decode(example)
der := block.Bytes
fromDER, err := x509.ParseCertificates(der)
if err != nil {
t.Fatal(err)
}

if !reflect.DeepEqual(fromPEM, fromDER) {
t.Fatal("certs not equal")
}

_, _, err = helpers.ParseCertificatesDER(der, "")
fmt.Println("DER parse error:", err)
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.