michael-o opened a new pull request, #1090: URL: https://github.com/apache/tomcat/pull/1090
`Asn1Parser.parseLength()`'s bounds-check guards (added in commits baee26a) all throw `IllegalArgumentException` via `asn1Parser.lengthInvalid`, but hardcode the reported length to `-1` in every case, even when the actual decoded value is known and would be useful for diagnosing the failure. This was discovered while upgrading [tomcatspnegoad](https://github.com/michael-o/tomcatspnegoad) from Tomcat 9.0.118 to 9.0.119, where its `OtherNameAsn1Parser` test suite (a thin wrapper around `Asn1Parser` used to decode the `SAN:otherName` field from X.509 client certificates, to extract an MS-UPN for Active Directory authentication) started failing due to the changed exception messages. This PR fixes two issues: 1. When the declared length is valid (correctly decoded, non-negative, no overflow) but exceeds the remaining input, the real length is now reported instead of `-1`. 2. The `bytes > 4` octet-count cap is replaced with a `BigInteger`-based check on the actual decoded magnitude. Per X.690 §8.1.3.5, a BER/DER length may use up to 126 octets and is always unsigned — the only real constraint here is that this implementation returns an `int`, so values exceeding `Integer.MAX_VALUE` cannot be represented. The old cap rejected some encodings (e.g. a non-minimal 5-octet length for a small value) that are valid per spec and now parse correctly, while cases that genuinely exceed `Integer.MAX_VALUE` get a new, accurately-worded message (`asn1Parser.lengthUnsupported`) instead of being misreported as "invalid." No behavior change for well-formed, in-range input. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
