commit 75653b1df010fe3dd71409c8b1f181b7b0f25f8f
author Przemek Stekiel <przemyslaw.stekiel@mobica.com> Wed Feb 01 11:31:32 2023 +0100
committer Przemek Stekiel <przemyslaw.stekiel@mobica.com> Tue Apr 04 17:48:28 2023 +0200
tree 8de4e39690bf8405c00db29fbaf3f95058bed47d
parent 6ec839a1f95c5270eb5347a675b4c7497638737c

Add indication of extension error while parsing authority/subject key id

Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>

library/x509_crt.c

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 1ebe96a..2477a93 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -600,7 +600,7 @@
 
     if ((ret = mbedtls_asn1_get_tag(p, end, &len,
                                     MBEDTLS_ASN1_OCTET_STRING)) != 0) {
-        return ret;
+        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
     } else {
         subject_key_id->len = len;
         subject_key_id->tag = MBEDTLS_ASN1_OCTET_STRING;
@@ -748,7 +748,7 @@
 
     if ((ret = mbedtls_asn1_get_tag(p, end, &len,
                                     MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
-        return ret;
+        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
     }
 
     if (*p + len != end) {
@@ -782,7 +782,7 @@
                                             MBEDTLS_ASN1_CONTEXT_SPECIFIC |
                                             MBEDTLS_ASN1_CONSTRUCTED |
                                             MBEDTLS_X509_SAN_DIRECTORY_NAME)) != 0) {
-                return ret;
+                return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
             } else {
                 /* "end" also includes the CertSerialNumber field so "len" shall be used */
                 ret = x509_get_general_names(p,
@@ -797,7 +797,7 @@
                                         MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_INTEGER)) !=
             0) {
             /* authorityCertSerialNumber is an OPTIONAL field, but if there are still data it must be the serial number */
-            return ret;
+            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
         } else {
             authority_key_id->authorityCertSerialNumber.len = len;
             authority_key_id->authorityCertSerialNumber.p = *p;