301383 - Original ASN1 decoder: problem decoding seqence if data is zero

Status: NEW

(NSS :: Libraries, defect, P2)

Description

[Alexei Volkov]

Original decode(SEC_ASN1DecodeItem) fails to decode template that consists of
a sequence of OPTIONAL | CONTEXT_SPECIFIC template in case then original data
for encoder were zero.

Here is the example template:
 const SEC_ASN1Template MyTestTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(MyTest)},
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 0,
      offsetof (MyTest, theItem0),
      SEC_ASN1_SUB(SEC_OctetStringTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 1,
      offsetof (MyTest, theItem1),
      SEC_ASN1_SUB(SEC_OctetStringTemplate) },
    { 0 }
};

Check attachment for example that reproduces the bug.

Comment 1

[Alexei Volkov]

Attachment: example

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Is an empty SEQUENCE permitted in X.680 and/or X.690?  
If empty SEQUENCEs are valid, allowed by the standards, then this is a 
valid bug.  Otherwise, it isn't.

BTW, what happens?  crash?  some error?  (What error?)

Comment 3

[Julien Pierre]

Alexei,

What happens when you use the QuickDER decoder instead ?

Nelson,

AFAIK, empty sequences are valid .

Comment 4

[Alexei Volkov]

Quote from X 680:
---====---
Type SEQUENCE is an ordered list of zero or more component types.
---====---

No crashes. Looks like the decoder expects one of the optional
items from the sequence to be present.

QuickDER successfully decodes the data.

Here is the output then DEBUG_ASN1D_STATES tuned on:

PLACE = beforeIdentifier, next byte = 0x30, 0804b3a0[0]
STATE: tmpl 08049c60, kind SEQUENCE beforeIdentifier, expect 0x30 0
Found tag 30  CONSTRUCTED SEQUENCE

PLACE = afterIdentifier, next byte = 0x00, 0804b3a1[0]
STATE: tmpl 08049c60, kind SEQUENCE afterIdentifier, expect 0x30 0

PLACE = beforeLength, next byte = 0x00, 0804b3a1[0]
STATE: tmpl 08049c60, kind SEQUENCE beforeLength, expect 0x30 0

PLACE = afterLength, next byte = 0x00, 0804b3a2[0]
STATE: tmpl 08049c60, kind SEQUENCE afterLength, expect 0x30 0
Found Length 0 

PLACE = beforeIdentifier, next byte = 0x00, 0804b3a2[0]
State: tmpl 08049c60, kind SEQUENCE duringSequence, expect 0x30 0
  State: tmpl 08049c70, kind CONTEXT_SPECIFIC [0] OPTIONAL afterImplicit, expect
0x00 0
  STATE: tmpl 4010674c, kind OCTET_STRING  beforeIdentifier, expect 0x80 0

Comment 5

[Julien Pierre]

Alexei,

Since you have already traced the decoder, I think you are the best qualified to
fix it at this point. I wonder if the encoder has the same bug .

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Adding Bob to ASN.1 encoder/decoder related bugs

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Unsetting target milestone in unresolved bugs whose targets have passed.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, and this bug has priority 'P2'.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 9

[Marco Castelluccio [:marco]]

We have modified the bot to only consider P1 as high priority, so I'm cancelling the needinfo here.