340887 - QuickDER decoder does not detect invalid empty OPTIONAL sequences

Status: RESOLVED INVALID

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Bug 340776 documents an OCSP response that includes an empty OPTIONAL 
SEQUENCE-OF.  Our QuickDER decoder did not detect it and report it as
invalid DER.  Our encode correctly re-encoded the response without the 
optional.  That is, the optional part was omitted because it was empty.
We detected the invalid DER repsonse because we compared the input to 
the decoder with the output of the encoder, and they did not match.

IMO, the QuickDER decoder should at least have an option to detect these
errors.  Perhaps we will at times wish to ignore these errors, but that
should be the optional behavior, not the default.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Maybe Bug 340776 isn't such a good example.  
Perhaps it wasn't empty after all.
But I believe this RFE is still valid.  
I don't think any of our ASN.1 decoders detects an empty optional.

Comment 2

[Julien Pierre]

Actually a SEQUENCE OF is allowed to have zero elements in the general case. This is valid to encode and decode. Some ASN.1 structures may be constrained in size and require a minimum or maximum of elements, which our templates are currently unable to express, and thus the decoders/encoders don't enforce it.
Thus, I think this bug may be invalid.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Upon rereading X.690, I cannot find any rule that requires empty optional 
values to be omitted.  So, I must reluctantly mark this invalid. :(