librasn / rasn

A Safe #[no_std] ASN.1 Codec Framework
Other
183 stars 43 forks source link

ia5 string decoding debug assertion reached from OER #260

Open pcwizz opened 2 weeks ago

pcwizz commented 2 weeks ago

The debug assertion at https://github.com/librasn/rasn/blob/main/src/types/strings/ia5.rs#L132 can be reached with via the OER decoder. In production build this assertion is not present resulting in invalid characters in the decoded string.

#[test]
fn invalid_ia5_oer() {
    let data: [u8; 9] = [
        129,
        129,
        10,
        129,
        4,
        0,
        0,
        129,
        129,
    ];

    let r = rasn::oer::decode::<rasn_ocsp::OcspRequest>(&data);
    println!("{:?}", r)
}
thread 'invalid_ia5_oer' panicked at src/types/strings/ia5.rs:132:9:
129 not in character set
stack backtrace:
   0: rust_begin_unwind
             at /rustc/a26981974230110fa8fb15e1cf04d05b9a2103f9/library/std/src/panicking.rs:652:5
   1: core::panicking::panic_fmt
             at /rustc/a26981974230110fa8fb15e1cf04d05b9a2103f9/library/core/src/panicking.rs:72:14
   2: <rasn::types::strings::ia5::Ia5String as rasn::types::strings::constrained::StaticPermittedAlphabet>::push_char
             at ./src/types/strings/ia5.rs:132:9
   3: rasn::types::strings::constrained::StaticPermittedAlphabet::try_from_bits
             at ./src/types/strings/constrained.rs:146:13
   4: rasn::oer::de::Decoder::parse_known_multiplier_string
             at ./src/oer/de.rs:354:9
   5: <rasn::oer::de::Decoder as rasn::de::Decoder>::decode_ia5_string
             at ./src/oer/de.rs:695:9
   6: <rasn::types::strings::ia5::Ia5String as rasn::de::Decode>::decode_with_tag_and_constraints
             at ./src/types/strings/ia5.rs:58:9
   7: rasn::de::Decode::decode_with_tag
             at ./src/de.rs:31:9
   8: <rasn_pkix::GeneralName as rasn::types::DecodeChoice>::from_tag
             at ./standards/pkix/src/lib.rs:692:33
   9: <rasn::oer::de::Decoder as rasn::de::Decoder>::decode_choice
             at ./src/oer/de.rs:833:13
  10: <rasn_pkix::GeneralName as rasn::de::Decode>::decode
             at ./standards/pkix/src/lib.rs:692:33
  11: <rasn::oer::de::Decoder as rasn::de::Decoder>::decode_explicit_prefix
             at ./src/oer/de.rs:734:9
  12: <rasn_ocsp::TbsRequest as rasn::de::Decode>::decode_with_tag_and_constraints::{{closure}}
             at ./standards/ocsp/src/lib.rs:29:33
  13: <rasn::oer::de::Decoder as rasn::de::Decoder>::decode_sequence
             at ./src/oer/de.rs:582:25
  14: <rasn_ocsp::TbsRequest as rasn::de::Decode>::decode_with_tag_and_constraints
             at ./standards/ocsp/src/lib.rs:29:33
  15: rasn::de::Decode::decode_with_tag
             at ./src/de.rs:31:9
  16: rasn::de::Decode::decode
             at ./src/de.rs:22:9
  17: <rasn_ocsp::OcspRequest as rasn::de::Decode>::decode_with_tag_and_constraints::{{closure}}
             at ./standards/ocsp/src/lib.rs:19:33
  18: <rasn::oer::de::Decoder as rasn::de::Decoder>::decode_sequence
             at ./src/oer/de.rs:582:25
  19: <rasn_ocsp::OcspRequest as rasn::de::Decode>::decode_with_tag_and_constraints
             at ./standards/ocsp/src/lib.rs:19:33
  20: rasn::de::Decode::decode_with_tag
             at ./src/de.rs:31:9
  21: rasn::de::Decode::decode
             at ./src/de.rs:22:9
  22: rasn::oer::decode
             at ./src/oer.rs:15:5
  23: invalidia5oer::invalid_ia5_oer
             at ./tests/invalidia5oer.rs:15:13
  24: invalidia5oer::invalid_ia5_oer::{{closure}}
             at ./tests/invalidia5oer.rs:2:21
  25: core::ops::function::FnOnce::call_once
             at /rustc/a26981974230110fa8fb15e1cf04d05b9a2103f9/library/core/src/ops/function.rs:250:5
  26: core::ops::function::FnOnce::call_once
             at /rustc/a26981974230110fa8fb15e1cf04d05b9a2103f9/library/core/src/ops/function.rs:250:5
XAMPPRocky commented 2 weeks ago

Cc @Nicceboy