[openssl/openssl] 3687ff: Don't raise NOT_ENOUGH_DATA on a clean EOF at an o...

  Branch: refs/heads/openssl-3.5
  Home:   https://github.com/openssl/openssl
  Commit: 3687ff719503ffc6d29c97d77e00199251890774
      https://github.com/openssl/openssl/commit/3687ff719503ffc6d29c97d77e00199251890774
  Author: Marc Gutman <[email protected]>
  Date:   2026-07-13 (Mon, 13 Jul 2026)

  Changed paths:
    M crypto/asn1/a_d2i_fp.c
    M doc/man3/ASN1_item_d2i_bio.pod
    M test/asn1_decode_test.c

  Log Message:
  -----------
  Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary

asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO.  Callers
commonly loop, decoding concatenated DER values until the call fails, and
rely on a failure with no queued error to recognise a clean end of input.
CPython's ssl module does this in _add_ca_certs() when loading the Windows
certificate store via SSLContext.load_verify_locations(cadata=...); it
re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as
fatal.

Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the
BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read()
returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now
raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue.
The rewrite in commit 35852da1d9 carried this behaviour forward.  As a
result Python 3 on Windows fails to initialise an SSLContext with:

    ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data

Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the
middle of an object (some bytes already buffered), or on an EOF while still
inside an indefinite-length value awaiting its end-of-contents octets - all
of which are genuine truncation.  A clean EOF at a top-level object boundary
again fails without queuing an error, restoring the long-standing behaviour
that looping callers depend on.

Add regression tests covering the clean-EOF, truncated, indefinite-length
truncation and partial-header cases, and document the read behaviour in
ASN1_item_d2i_bio(3).

Fixes #31807

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Igor Ustinov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jul 13 08:05:03 2026
(Merged from https://github.com/openssl/openssl/pull/31818)

(cherry picked from commit d7e77b66cabb770932091ed5986221e0d1e57144)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.5/f63a2e-3687ff%40github.com.