encoding/asn1: accepts non-minimal OID encoding #36881
Closed
Description
go version go1.13.4 linux/amd64
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env GO111MODULE="" GOARCH="amd64" GOBIN="" GOCACHE="/home/jsha/.cache/go-build" GOENV="/home/jsha/.config/go/env" GOEXE="" GOFLAGS="" GOHOSTARCH="amd64" GOHOSTOS="linux" GONOPROXY="" GONOSUMDB="" GOOS="linux" GOPATH="/home/jsha/go" GOPRIVATE="" GOPROXY="https://proxy.golang.org,direct" GOROOT="/home/jsha/go1.13" GOSUMDB="sum.golang.org" GOTMPDIR="" GOTOOLDIR="/home/jsha/go1.13/pkg/tool/linux_amd64" GCCGO="gccgo" AR="ar" CC="gcc" CXX="g++" CGO_ENABLED="1" GOMOD="" CGO_CFLAGS="-g -O2" CGO_CPPFLAGS="" CGO_CXXFLAGS="-g -O2" CGO_FFLAGS="-g -O2" CGO_LDFLAGS="-g -O2" PKG_CONFIG="pkg-config" GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build221529794=/tmp/go-build -gno-record-gcc-switches"
What did you do?
Passed an invalidly-encoded OID to asn1.Unmarshal
What did you expect to see?
Parse error.
What did you see instead?
Successful parse.
Here's an example program demonstrating the problem, along with a reference to the ASN.1 spec:
https://play.golang.org/p/ETqZ6Kxz16G
package main
import (
"encoding/asn1"
"encoding/hex"
"fmt"
"log"
)
func main() {
var o asn1.ObjectIdentifier
// Correct encoding; each component of the ObjectIdentifier is encoded
// minimally.
s, err := hex.DecodeString("06092a864886f70d01010b")
if err != nil {
log.Fatal(err)
}
_, err = asn1.Unmarshal(s, &o)
if err != nil {
log.Fatal(err)
}
fmt.Println(o)
// Incorrect encoding; the 0x80 byte encodes a zero prefix in base 128, which
// violate's X.690's requirement to minimally-encode OIDs (which applies
// to both BER and DER). Ref: X.690 2015, §8.19.2 "The subidentifier shall be
// encoded in the fewest possible octets, that is, the leading octet of the
// subidentifier shall not have the value [0x80]"
s, err = hex.DecodeString("060a2a80864886f70d01010b")
if err != nil {
log.Fatal(err)
}
_, err = asn1.Unmarshal(s, &o)
if err != nil {
log.Fatal(err)
}
fmt.Println(o)
}