Repository navigation
pem-rfc7468: accept a lone CR before the pre-encapsulation boundary - #2488
Open
choksi2212 wants to merge 1 commit into
Open
choksi2212 wants to merge 1 commit into
choksi2212 wants to merge 1 commit into
Conversation
Section 3's grammar ends every line with eol = CRLF / CR / LF, and the eol helpers already accept a lone CR, but strip_preamble only looked for the boundary after an LF. A preamble ended by a lone CR (or the previous message's trailing eol in a multi-certificate chain) was refused as Error::Preamble even though the boundary follows it. Accept a CR followed by the boundary the same way the LF case is accepted. A CRLF is unaffected: the CR is then followed by the LF, not the boundary, so the walk still lands on the LF arm. Fixes RustCrypto#2486 Signed-off-by: choksi2212 <choksi2212@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2486.
Section 3 ends every line with
eol = CRLF / CR / LF, and the crate's ownstrip_leading_eol/strip_trailing_eoltake all three, butstrip_preambleonly looked for the boundary after an LF. A preamble line ended by a lone CR was refused asError::Preambleeven with-----BEGINright behind it. The case that bites is a chain:Certificate::load_pem_chainsplits after each-----END CERTIFICATE-----, so the second message of a chain begins with the first one's trailing eol. With LF or CRLF that decodes; with a lone CR the whole chain is refused.This adds the matching CR arm next to the LF arm. CRLF is untouched: the CR there is followed by the LF, not the boundary, so the walk still lands on the LF case.
The new tests cover the lone-CR preamble line, the chain hand-off with the whole message CR-wrapped, and a bare CR before the boundary, plus pins for the CRLF path and the NUL refusal. On the pre-change crate the four CR tests fail with exactly
Err(Preamble)and they pass here;cargo test -p pem-rfc7468is green with and without default features, clippy is clean under-D warnings, andcargo check --workspace --all-featuresstill passes.