Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

test(mbedtls): cover certificate extent checks in bundle bound checking

Browse Source 
Add a bound-checking case for the two cert-extent rejections in
esp_crt_check_bundle(): a certificate whose declared name/key lengths
run past the end of the bundle, and a last certificate placed so close
to the end that its 4-byte header would straddle the bundle boundary.
This commit is contained in:
harshal.patil
2026-08-31 13:31:36 +08:00
committed by BOT
parent ed7153ef41
commit 8bbec50449
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mbedtls/test_apps/mbedtls_ut/main/test_esp_crt_bundle.c
+28
View File
@@ -621,6 +621,34 @@ TEST_CASE("custom certificate bundle init API - bound checking - Incorrect certi
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG, esp_ret);
}
TEST_CASE("custom certificate bundle init API - bound checking - Certificate extent beyond end of bundle", "[mbedtls]")
{
uint8_t test_bundle[1024] = {0};
const size_t bundle_size = 64;
esp_err_t esp_ret;
/* Check that the esp_crt_bundle_set API will not accept a bundle whose only
certificate declares name/key lengths that run past the end of the bundle */
*((uint32_t*) &test_bundle[0]) = sizeof(uint32_t); // 1 cert, starting right after the offset list
*((uint16_t*) &test_bundle[4]) = 100; // Cert 1 name len
*((uint16_t*) &test_bundle[6]) = 100; // Cert 1 key len: 4 + 100 + 100 > bundle_size
esp_ret = esp_crt_bundle_set(test_bundle, bundle_size);
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG, esp_ret);
/* Check that the esp_crt_bundle_set API will not accept a bundle where the last
certificate starts so close to the end that its 4-byte header (name len +
key len) would straddle the end of the bundle */
memset(test_bundle, 0, sizeof(test_bundle));
*((uint32_t*) &test_bundle[0]) = 2 * sizeof(uint32_t); // 2 certs
*((uint32_t*) &test_bundle[4]) = bundle_size - 2; // Cert 2 offset: 2 bytes before the end
*((uint16_t*) &test_bundle[8]) = 25; // Cert 1 name len
*((uint16_t*) &test_bundle[10]) = 25; // Cert 1 key len: cert 2 expected at 8 + 4 + 25 + 25 = bundle_size - 2
esp_ret = esp_crt_bundle_set(test_bundle, bundle_size);
TEST_ASSERT_EQUAL(ESP_ERR_INVALID_ARG, esp_ret);
}
#if defined(CONFIG_MBEDTLS_HAVE_TIME_DATE)
TEST_CASE("certificate bundle - expired cert rejected with time-date check", "[mbedtls]")
{