|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Joyee Cheung <joyeec9h3@gmail.com> |
| 3 | +Date: Thu, 20 Nov 2025 13:50:28 +0900 |
| 4 | +Subject: src: handle DER decoding errors from system certificates |
| 5 | + |
| 6 | +When decoding certificates from the system store, it's not actually |
| 7 | +guaranteed to succeed. In case the system returns a certificate |
| 8 | +that cannot be decoded (might be related to SSL implementation issues), |
| 9 | +skip them. |
| 10 | + |
| 11 | +diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc |
| 12 | +index 96f6ea29525bc2c60297e7be5bc1d0b74cd568e1..9b83f8d6b2c7639044e739a7f055e457882370a2 100644 |
| 13 | +--- a/src/crypto/crypto_context.cc |
| 14 | ++++ b/src/crypto/crypto_context.cc |
| 15 | +@@ -507,7 +507,11 @@ void ReadMacOSKeychainCertificates( |
| 16 | + CFRelease(search); |
| 17 | + |
| 18 | + if (ortn) { |
| 19 | +- fprintf(stderr, "ERROR: SecItemCopyMatching failed %d\n", ortn); |
| 20 | ++ per_process::Debug(DebugCategory::CRYPTO, |
| 21 | ++ "Cannot read certificates from system because " |
| 22 | ++ "SecItemCopyMatching failed %d\n", |
| 23 | ++ ortn); |
| 24 | ++ return; |
| 25 | + } |
| 26 | + |
| 27 | + CFIndex count = CFArrayGetCount(curr_anchors); |
| 28 | +@@ -518,7 +522,9 @@ void ReadMacOSKeychainCertificates( |
| 29 | + |
| 30 | + CFDataRef der_data = SecCertificateCopyData(cert_ref); |
| 31 | + if (!der_data) { |
| 32 | +- fprintf(stderr, "ERROR: SecCertificateCopyData failed\n"); |
| 33 | ++ per_process::Debug(DebugCategory::CRYPTO, |
| 34 | ++ "Skipping read of a system certificate " |
| 35 | ++ "because SecCertificateCopyData failed\n"); |
| 36 | + continue; |
| 37 | + } |
| 38 | + auto data_buffer_pointer = CFDataGetBytePtr(der_data); |
| 39 | +@@ -526,9 +532,19 @@ void ReadMacOSKeychainCertificates( |
| 40 | + X509* cert = |
| 41 | + d2i_X509(nullptr, &data_buffer_pointer, CFDataGetLength(der_data)); |
| 42 | + CFRelease(der_data); |
| 43 | ++ |
| 44 | ++ if (cert == nullptr) { |
| 45 | ++ per_process::Debug(DebugCategory::CRYPTO, |
| 46 | ++ "Skipping read of a system certificate " |
| 47 | ++ "because decoding failed\n"); |
| 48 | ++ continue; |
| 49 | ++ } |
| 50 | ++ |
| 51 | + bool is_valid = IsCertificateTrustedForPolicy(cert, cert_ref); |
| 52 | + if (is_valid) { |
| 53 | + system_root_certificates_X509->emplace_back(cert); |
| 54 | ++ } else { |
| 55 | ++ X509_free(cert); |
| 56 | + } |
| 57 | + } |
| 58 | + CFRelease(curr_anchors); |
| 59 | +@@ -638,7 +654,14 @@ void GatherCertsForLocation(std::vector<X509*>* vector, |
| 60 | + reinterpret_cast<const unsigned char*>(cert_from_store->pbCertEncoded); |
| 61 | + const size_t cert_size = cert_from_store->cbCertEncoded; |
| 62 | + |
| 63 | +- vector->emplace_back(d2i_X509(nullptr, &cert_data, cert_size)); |
| 64 | ++ X509* x509 = d2i_X509(nullptr, &cert_data, cert_size); |
| 65 | ++ if (x509 == nullptr) { |
| 66 | ++ per_process::Debug(DebugCategory::CRYPTO, |
| 67 | ++ "Skipping read of a system certificate " |
| 68 | ++ "because decoding failed\n"); |
| 69 | ++ } else { |
| 70 | ++ vector->emplace_back(x509); |
| 71 | ++ } |
| 72 | + } |
| 73 | + } |
| 74 | + |
0 commit comments