Panic when parsing invalid certificate

[liranwiz]

Calling Parse with the following input result in panic: [48,130,6] at https://github.com/mozilla-services/pkcs7/blob/master/ber.go#L191 Expected behavior would have been returning an error

[reedloden]

Does https://github.com/mozilla-services/pkcs7/pull/68 fix this?

[nszetei]

@reedloden I checked and looks like it does. Here is another one, which is valid for both.

package pkcs7

import (
    "testing"
)

func TestBer2Der_Panic(t *testing.T) {
    fixtures := []struct {
        Input         []byte
        ErrorContains string
    }{
        {[]byte{0x5f, 0x4d}, "panic test"},
    }

    for _, fixture := range fixtures {
        ber2der(fixture.Input)
    }
}

$ go test

--- FAIL: TestBer2Der_Panic (0.00s)
panic: runtime error: index out of range [2] with length 2 [recovered]
    panic: runtime error: index out of range [2] with length 2

goroutine 6 [running]:
testing.tRunner.func1.2({0x11eeac0, 0xc00001e150})
    /usr/local/opt/go/libexec/src/testing/testing.go:1389 +0x24e
testing.tRunner.func1()
    /usr/local/opt/go/libexec/src/testing/testing.go:1392 +0x39f
panic({0x11eeac0, 0xc00001e150})
    /usr/local/opt/go/libexec/src/runtime/panic.go:838 +0x207
go.mozilla.org/pkcs7.readObject({0xc00001c530?, 0x100db27?, 0x2?}, 0x11cd760?)
    /tmp/pkcs7/ber.go:173 +0x814
go.mozilla.org/pkcs7.ber2der({0xc00001c530, 0x2, 0x2})
    /tmp/pkcs7/ber.go:64 +0x65
go.mozilla.org/pkcs7.TestBer2Der_Panic(0x0?)
    /tmp/pkcs7/ber_test.go:18 +0xba
testing.tRunner(0xc000110ea0, 0x122b0d8)
    /usr/local/opt/go/libexec/src/testing/testing.go:1439 +0x102
created by testing.(*T).Run
    /usr/local/opt/go/libexec/src/testing/testing.go:1486 +0x35f
exit status 2
FAIL    go.mozilla.org/pkcs7    0.009s