Closed plusvic closed 4 months ago
This is indeed a serious problem (unwanted panic
in a library), thanks for reporting it
I am investigating for a solution
Thank you for the fix! Any plans to publish a release that includes this fix?
The fix has been published in asn1-rs-derive
0.5.1
A simple cargo update
on this crate should be enough (there is no breaking change).
Great! Thank you!
The code generated by both BerSequence and DerSequence for the
TryFrom<Any>
trait uses the finish function for error convertion. The issue withfinish
is that it can panic when the parser's result isErr(Err::Incomplete(_))
. This is problematic when parsing ASN.1 structures that are corrupted.I've found this issue while trying to use the x509-parser crate for parsing X509 certificates in Windows PE files. The files are sometimes corrupt, and make the program panic.
Consider the AlgorithmIdentifier structure:
The code generated by
DerSequence
for thetry_from
function looks like:Notice the use of
finish
after parsing both thealgorithm
andparameters
fields. The documentation forfinish
says:So, it looks like "streaming" parsing is being used, but I'm not sure if that's the case, or why.