saymrwulf/cryptography
1
0
Fork 0
mirror of https://github.com/saymrwulf/cryptography.git synced 2026-05-14 20:37:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed crash when loading a PKCS#7 bundle with no certificates (#9926)

Browse source
This commit is contained in:
Alex Gaynor 2023-11-27 13:08:17 -05:00 committed by GitHub
parent 69ab6f96c5
commit 1e7b4d074e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/cryptography/hazmat/backends/openssl/backend.py
View file

@ -1111,9 +1111,12 @@ class Backend:
_Reasons.UNSUPPORTED_SERIALIZATION,
)
certs: list[x509.Certificate] = []
if p7.d.sign == self._ffi.NULL:
return certs
sk_x509 = p7.d.sign.cert
num = self._lib.sk_X509_num(sk_x509)
certs = []
for i in range(num):
x509 = self._lib.sk_X509_value(sk_x509, i)
self.openssl_assert(x509 != self._ffi.NULL)

6
tests/hazmat/primitives/test_pkcs7.py
View file

@ -89,6 +89,12 @@ class TestPKCS7Loading:
mode="rb",
)
def test_load_pkcs7_empty_certificates(self):
der = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"
certificates = pkcs7.load_der_pkcs7_certificates(der)
assert certificates == []
# We have no public verification API and won't be adding one until we get
# some requirements from users so this function exists to give us basic