How does CVE-2021-43527 impact certificate chains?

(hopefully the correct address)

I'm trying to understand CVE-2021-43527 and how it impacts verifying
an untrusted end cert starting with a trusted root cert.

In the blog https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html
the example uses a self signed certificate.  This means we have:

    vfy_CreateContext(key=untrusted, sig=untrusted)
               sigLen = SECKEY_SignatureLen(key);
               ...
               if (sig->len != sigLen) {
                   PORT_SetError(SEC_ERROR_BAD_SIGNATURE);

i.e., both SECKEY_SignatureLen(key) and sig-len are coming from the
wire (untrusted source).

However, when calling this function via CERT_PKIXVerifyCert(), the
calls look more like:

    vfy_CreateContext(key=trusted, sig=untrusted)

(trusted is either the root cert, or a previously authenticated
certificate) which would mean that the (sig->len != sigLen) does the
right thing?

-- 
You received this message because you are subscribed to the Google Groups "[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAJeAr6t3hcd8qHwgP9mqSSMNmk5Usgq3o43JR%2BvVmBV4Q8o%3Dow%40mail.gmail.com.