Repository navigation
X509 fix minor - #12131
X509 fix minor#12131aidankeefe2022 wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues were identified for the X.509 extension memory-safety changes and accompanying regression coverage.
No open issues 🎉
What changed in this PR
This PR fixes memory-safety issues in wolfSSL’s OpenSSL-compatible X.509 extension handling and adds regression coverage.
Changes:
- Handles empty authority-information-access entries and copies key identifiers from their original encoded data.
- Releases the preallocated string before storing a directory-name subject alternative name.
- Adds regression tests and a certificate fixture with generation and distribution support.
| File | Description |
|---|---|
tests/api/test_ossl_x509_ext.h |
Declares and registers the new regression tests. |
tests/api/test_ossl_x509_ext.c |
Tests directory-name SANs, empty AIA stacks, and variable-length key identifiers. |
src/x509.c |
Fixes null handling, key-identifier copying, and directory-name memory ownership. |
certs/test/include.am |
Adds the certificate fixture files to source distributions. |
certs/test/gen-ext-certs.sh |
Adds generation of the directory-name SAN certificate. |
certs/test/cert-ext-dirsan.pem |
Provides the certificate fixture used by the SAN regression test. |
certs/test/cert-ext-dirsan.cfg |
Defines the fixture’s DNS and directory-name SAN entries. |
Review effort: Balanced
|
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #12131
Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): certs/test/cert-ext-dirsan.cfg, certs/test/cert-ext-dirsan.der, certs/test/cert-ext-dirsan.pem, certs/test/gen-ext-certs.sh, certs/test/include.am, tests/api/test_ossl_x509_ext.h
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Max
Description
F-7325: Write before free
F-16325 NULL dereference
F-16327 Out-of-bounds read
Fixes zd https://wolfssl.zendesk.com/agent/tickets/22767 and https://wolfssl.zendesk.com/agent/tickets/22764
Testing
regression tests.
Checklist