gh-Mbed-TLS/TF-PSA-Crypto

Watch

Fork 0

asn1write: reject NULL integer buffers before dereferencing them #920

Open

ManoharPaturi wants to merge 1 commit from ManoharPaturi/fix-asn1write-null-guard into development

ManoharPaturi commented

2026-09-29 11:03:11 -05:00

(Migrated from github.com)

Problem

mbedtls_asn1_write_integer() dereferences the integer buffer before its own NULL guard (utilities/asn1write.c):

while ((number_of_leading_zeros < integer_length)
       && (integer[number_of_leading_zeros] == 0x0)) {    /* dereference */
    number_of_leading_zeros++;
}

if (integer != NULL) {                                     /* dead/misleading guard */
    integer_start = integer + number_of_leading_zeros;
}

A caller passing integer == NULL with integer_length > 0 (the guard implies that was meant to be tolerated) crashes on the first loop iteration instead of receiving an error.

Fix

Move the NULL handling above the loop and return MBEDTLS_ERR_ASN1_BAD_INPUT_DATA for NULL with a non-zero length; a zero-length NULL buffer keeps its existing meaning (empty INTEGER).

Verification

Branch builds clean; a one-line case in the asn1write test suite covers both shapes.

## Problem `mbedtls_asn1_write_integer()` dereferences the integer buffer before its own NULL guard (utilities/asn1write.c): ```c while ((number_of_leading_zeros < integer_length) && (integer[number_of_leading_zeros] == 0x0)) { /* dereference */ number_of_leading_zeros++; } if (integer != NULL) { /* dead/misleading guard */ integer_start = integer + number_of_leading_zeros; } ``` A caller passing `integer == NULL` with `integer_length > 0` (the guard implies that was meant to be tolerated) crashes on the first loop iteration instead of receiving an error. ## Fix Move the NULL handling above the loop and return `MBEDTLS_ERR_ASN1_BAD_INPUT_DATA` for `NULL` with a non-zero length; a zero-length NULL buffer keeps its existing meaning (empty INTEGER). ## Verification Branch builds clean; a one-line case in the `asn1write` test suite covers both shapes.

copilot-pull-request-reviewer[bot] (Migrated from github.com) reviewed

2026-09-29 11:03:17 -05:00

copilot-pull-request-reviewer[bot] (Migrated from github.com) left a comment

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin 'ManoharPaturi/fix-asn1write-null-guard:ManoharPaturi/fix-asn1write-null-guard'

git switch 'ManoharPaturi/fix-asn1write-null-guard'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'development'

git merge --no-ff 'ManoharPaturi/fix-asn1write-null-guard'

git switch 'ManoharPaturi/fix-asn1write-null-guard'

git rebase 'development'

git switch 'development'

git merge --ff-only 'ManoharPaturi/fix-asn1write-null-guard'

git switch 'ManoharPaturi/fix-asn1write-null-guard'

git rebase 'development'

git switch 'development'

git merge --no-ff 'ManoharPaturi/fix-asn1write-null-guard'

git switch 'development'

git merge --squash 'ManoharPaturi/fix-asn1write-null-guard'

git switch 'development'

git merge --ff-only 'ManoharPaturi/fix-asn1write-null-guard'

git switch 'development'

git merge 'ManoharPaturi/fix-asn1write-null-guard'

git push origin 'development'

No reviewers

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto!920

No description provided.

Rows
Columns