certificatePolicies fixes - #11221
Open
gasbytes wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens X.509 certificatePolicies extension parsing to better match RFC 5280 requirements and adds regression coverage to prevent acceptance of malformed inputs.
Changes:
- Reject empty
certificatePoliciessequences (RFC 5280 §4.2.1.4:SEQUENCE SIZE (1..MAX)). - Ensure trailing bytes after the final
PolicyInformationare rejected (not silently ignored). - Add/adjust regression tests exercising both conditions.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
wolfcrypt/src/asn.c |
Enforces non-empty certificatePolicies and iterates through the full decoded sequence to catch trailing junk. |
tests/unit-mcdc/test_asn_ext_whitebox.c |
Updates whitebox expectation for empty certificatePolicies to require failure. |
tests/api/test_asn.h |
Adds declarations/registration for new ASN extension regression tests. |
tests/api/test_asn.c |
Adds regression tests for empty certificatePolicies and trailing-junk rejection. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
gasbytes
force-pushed
the
certificatePolicies-fix
branch
from
August 20, 2026 16:06
dae7c7c to
0653ac9
Compare
gasbytes
marked this pull request as ready for review
August 20, 2026 16:57
gasbytes
force-pushed
the
certificatePolicies-fix
branch
from
August 20, 2026 16:57
0653ac9 to
952c579
Compare
|
retest this please |
|
gasbytes
force-pushed
the
certificatePolicies-fix
branch
2 times, most recently
from
August 21, 2026 14:12
a222443 to
e0d985d
Compare
Contributor
Author
|
Jenkins retest this please. (TIMEOUT) |
SparkiDev
requested review from
wolfSSL-Fenrir-bot
and removed request for
wolfSSL-Fenrir-bot
August 25, 2026 00:14
wolfSSL-Fenrir-bot
requested changes
Aug 25, 2026
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11221
Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
…er RFC 5280 4.2.1.4; - asn: reject trailing bytes after the last PolicyInformation in certificatePolicies; - minor edit updating the whitebox notes to match these new changes;
gasbytes
force-pushed
the
certificatePolicies-fix
branch
from
August 25, 2026 13:44
e0d985d to
83594b9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Two simple and small fixes on how certificatePolicies are handled:
And a minor edit updating the whitebox notes to match with these changes.
Testing
Added two regression tests, one for each test.
Checklist