Skip to content

fix: reject invalid x5c chain lengths before parsing - #302

Open
visheshupadhyay wants to merge 2 commits into
apple:mainfrom
visheshupadhyay:fix/reject-invalid-x5c-chain-length
Open

visheshupadhyay wants to merge 2 commits into
apple:mainfrom
visheshupadhyay:fix/reject-invalid-x5c-chain-length

Conversation

@visheshupadhyay

Copy link
Copy Markdown

Fixes #301

@dxnnystyles dxnnystyles left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice addition with the early null guard! one case missing from the new tests is verifyChain(null, ...). since this changes a NullPointerException into INVALID_CHAIN_LENGTH, an assertion for that exact input would help protect the new behavior :)

@visheshupadhyay

Copy link
Copy Markdown
Author

Thanks for catching that, @dxnnystyles. I’ve added explicit coverage for verifyChain(null, ...) to verify that it returns INVALID_CHAIN_LENGTH rather than throwing a NullPointerException.

I also ran the focused ChainVerifierTest suite successfully.

@dxnnystyles dxnnystyles left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for adding this! I checked the updated test, and it now covers verifyChain(null, ...) with the expected INVALID_CHAIN_LENGTH status. the early rejection also prevents certificate parsing for invalid chain lengths. looks good!

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Reject invalid x5c chain lengths before certificate parsing

2 participants