From 1f3ba042302fad4b9dd48dd6c0f31fc74fb2e563 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Fri, 4 Sep 2026 14:14:35 +0200 Subject: [PATCH] asn: check CALLOC_ASNGETDATA result before use in DecodeCertInternal Under WOLFSSL_SMALL_STACK the macro heap-allocates and reports failure through its err argument, but RPKdataASN was indexed before ret was tested, so an allocation failure dereferenced NULL while parsing any certificate. The MEMORY_E was also discarded, since the following GetASN_Items overwrote ret. Audited the other 57 ALLOC_ASNGETDATA/CALLOC_ASNGETDATA call sites; this was the only unguarded one. --- wolfcrypt/src/asn.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c index 253f94da20c..6623eb858bb 100644 --- a/wolfcrypt/src/asn.c +++ b/wolfcrypt/src/asn.c @@ -23274,12 +23274,14 @@ static int DecodeCertInternal(DecodedCert* cert, int verify, int* criticalExt, word32 rpkStartIdx = cert->srcIdx; DECL_ASNGETDATA(RPKdataASN, RPKCertASN_Length); CALLOC_ASNGETDATA(RPKdataASN, RPKCertASN_Length, ret, cert->heap); - GetASN_OID(&RPKdataASN[RPKCERTASN_IDX_SPUBKEYINFO_ALGO_OID], + if (ret == 0) { + GetASN_OID(&RPKdataASN[RPKCERTASN_IDX_SPUBKEYINFO_ALGO_OID], oidKeyType); - GetASN_OID(&RPKdataASN[RPKCERTASN_IDX_SPUBKEYINFO_ALGO_CURVEID], + GetASN_OID(&RPKdataASN[RPKCERTASN_IDX_SPUBKEYINFO_ALGO_CURVEID], oidCurveType); - ret = GetASN_Items(RPKCertASN, RPKdataASN, RPKCertASN_Length, 1, - cert->source, &cert->srcIdx, cert->maxIdx); + ret = GetASN_Items(RPKCertASN, RPKdataASN, RPKCertASN_Length, 1, + cert->source, &cert->srcIdx, cert->maxIdx); + } if (ret == 0) { if (( RPKdataASN[RPKCERTASN_IDX_SPUBKEYINFO_ALGO_NULL].length &&