Now handling critical extensions similarly to how its done in x509_get_crt_ext just without the callback function to handle unknown extensions.
Signed-off-by: Matthias Schulz <mschulz@hilscher.com>
diff --git a/library/x509_csr.c b/library/x509_csr.c
index ce4c081..baf2606 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -75,13 +75,13 @@
static int x509_csr_parse_extensions(mbedtls_x509_csr *csr,
unsigned char **p, const unsigned char *end)
{
- int ret;
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t len;
unsigned char *end_ext_data;
- int critical;
while (*p < end) {
mbedtls_x509_buf extn_oid = { 0, 0, NULL };
+ int is_critical = 0; /* DEFAULT FALSE */
int ext_type = 0;
/* Read sequence tag */
@@ -102,8 +102,11 @@
extn_oid.p = *p;
*p += extn_oid.len;
- /* Get and ignore optional critical flag */
- (void)mbedtls_asn1_get_bool(p, end_ext_data, &critical);
+ /* Get optional critical */
+ if ((ret = mbedtls_asn1_get_bool(p, end_ext_data, &is_critical)) != 0 &&
+ (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)) {
+ return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
+ }
/* Data should be octet string type */
if ((ret = mbedtls_asn1_get_tag(p, end_ext_data, &len,
@@ -157,6 +160,12 @@
default:
break;
}
+ } else {
+ if (is_critical) {
+ /* Data is marked as critical: fail */
+ return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
+ MBEDTLS_ERR_ASN1_UNEXPECTED_TAG);
+ }
}
*p = end_ext_data;
}