Harden chain depth bounds and parser input validation by ColtonWilley · Pull Request #10209 · wolfSSL/wolfssl

ColtonWilley · 2026-04-13T20:14:45Z

Summary

Harden certificate-chain depth handling and parser input validation.

Enforce MAX_CHAIN_DEPTH in certificate loading (ProcessUserChain), OCSP
stapling (SendCertificateStatus), and TLS 1.3 certificate send
(SendTls13Certificate). The load-time check runs after a cert is parsed,
so a full-depth chain followed by trailing data still loads.
Add idx bounds checks to the peer-chain accessors in ssl.c.
SendCertificateStatus: bound the OCSP chain loops by MAX_CHAIN_DEPTH and
error on an over-long chain rather than silently truncating the response.
Harden TLSX_SNI_GetFromBuffer length validation (require
listLen == extLen - OPAQUE16_LEN, bound sniLen) against overreads on a
malformed ClientHello.
Fix an off-by-one in TLSX_CSR_Free (<= to <).
Bounds-check wc_PKCS7_DecodeAuthEnvelopedData against truncated input
(encryptedContentSz, the authTag tag read, authTagSz) under NO_PKCS7_STREAM.

Tests

Chain-depth boundary and chain-accessor index bounds in tests/api.c.
AuthEnvelopedData truncation cases in test_pkcs7.c.
Remove test_dtls13_oversized_cert_chain, superseded by the load-time cap.

github-actions · 2026-05-06T03:16:08Z

MemBrowse Memory Report

gcc-arm-cortex-m3

FLASH: .text +28 B (+0.0%, 121,281 B / 262,144 B, total: 46% used)

gcc-arm-cortex-m4

FLASH: .text +64 B (+0.0%, 198,894 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-openssl-compat

FLASH: .text +64 B (+0.0%, 766,828 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pq

FLASH: .text +64 B (+0.0%, 277,592 B / 1,048,576 B, total: 26% used)

gcc-arm-cortex-m4-rsa-only

FLASH: .text +64 B (+0.0%, 323,000 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls12

FLASH: .text +64 B (+0.1%, 122,061 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

FLASH: .text +64 B (+0.0%, 234,528 B / 262,144 B, total: 89% used)

gcc-arm-cortex-m7

FLASH: .text +64 B (+0.0%, 198,894 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

FLASH: .text +64 B (+0.0%, 278,168 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

FLASH: .text +64 B (+0.0%, 234,592 B / 262,144 B, total: 89% used)
No memory changes detected for:
gcc-arm-cortex-m0plus
gcc-arm-cortex-m4-baremetal
gcc-arm-cortex-m4-crypto-only
gcc-arm-cortex-m4-dtls13
gcc-arm-cortex-m4-min-ecc
gcc-arm-cortex-m4-pkcs7
gcc-arm-cortex-m4-sp-math
linuxkm-pie
linuxkm-standard
stm32-sim-stm32h753

github-actions · 2026-05-27T21:22:31Z

retest this please

Enforce MAX_CHAIN_DEPTH limits in OCSP chain processing (SendCertificateStatus, ProcessChainOCSPRequest), certificate loading (ProcessUserChain), and TLS 1.3 certificate sending (SendTls13Certificate). Add idx bounds checks to chain accessors in ssl.c. Harden SNI extension parser (TLSX_SNI_GetFromBuffer) with length checks preventing buffer overreads on malformed ClientHello. Fix off-by-one in TLSX_CSR_Free where <= should be < since csr->requests is a count, not a max index. Add remaining-buffer bounds checks to PKCS7 decoders: DecodeEnvelopedData, DecodeAuthEnvelopedData (encryptedContentSz and authTagSz), DecodeEncryptedData, SignedData null signature tag, and PwriKek_KeyUnWrap cekLen validation.

test_dtls13_oversized_cert_chain (added upstream in 1653ecd) loaded a >9-cert chain to exercise SendTls13Certificate's word16 overflow guard. This PR now rejects over-MAX_CHAIN_DEPTH chains at load in ProcessUserChain, so the chain never reaches the send path; the load-time rejection is covered by test_wolfSSL_CTX_use_certificate_chain_buffer_max_depth. The word16 send guard remains as defense-in-depth (now only reachable via large PQC chains).

Copilot

Pull request overview

This PR hardens certificate-chain depth handling and improves parser input validation to prevent out-of-bounds access and buffer overreads, with accompanying API/regression tests.

Changes:

Enforces MAX_CHAIN_DEPTH in certificate chain loading/sending paths and adds index bounds checks to chain accessors.
Hardens SNI extension parsing with stricter length validation and fixes an off-by-one in OCSP CSR cleanup.
Adds PKCS7 AuthEnvelopedData truncation regression coverage and updates API tests; removes a DTLS oversized-chain test.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`wolfcrypt/src/pkcs7.c`	Adds remaining-buffer bounds checks during AuthEnvelopedData parsing.
`src/tls.c`	Tightens SNI extension length validation; fixes OCSP CSR free-loop off-by-one.
`src/ssl.c`	Adds `idx` bounds checks for peer-chain accessors (`length/cert/X509`).
`src/ssl_load.c`	Enforces `MAX_CHAIN_DEPTH` during user chain parsing/loading.
`src/internal.c`	Bounds OCSP chain processing loops by `MAX_CHAIN_DEPTH`.
`src/tls13.c`	Rejects TLS 1.3 certificate sends when chain count exceeds `MAX_CHAIN_DEPTH`.
`tests/api/test_pkcs7.h`	Declares/registers new PKCS7 truncated AuthEnvelopedData test.
`tests/api/test_pkcs7.c`	Adds new truncation regression test for AuthEnvelopedData decode.
`tests/api/test_dtls.h`	Removes declaration/registration of oversized-chain DTLS 1.3 test.
`tests/api/test_dtls.c`	Removes implementation of oversized-chain DTLS 1.3 test.
`tests/api.c`	Adds tests for chain accessor idx bounds and max-depth chain buffer rejection.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

julek-wolfssl

Copilot has some valid points

- pkcs7.c: wrap the AuthEnvelopedData encryptedContentSz bounds check entirely in #ifdef NO_PKCS7_STREAM so the default streaming build carries no empty/no-op branch (behavior unchanged). - test_pkcs7.c: assert the encoded size is >32 so the encSz-32 and encSz-1 truncations can't underflow.

Master's test reorg (c674cec) moved test_dtls13_oversized_cert_chain into the new tests/api/test_dtls13.c. This branch removes that test, so resolve by taking master's test_dtls.{c,h} and re-applying the removal in test_dtls13.{c,h}.

ColtonWilley · 2026-06-04T17:15:57Z

Copilot has some valid points

Agreed, I have pushed updates to address the issues.

ColtonWilley · 2026-06-05T17:02:58Z

Jenkins retest this please

Fixed

dgarske

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Medium] MAX_CHAIN_DEPTH check placement can reject a valid maximum-depth chain that has trailing data — src/ssl_load.c:328-333
[Low] Max-depth load test overshoots the limit and omits the exact-boundary success case — tests/api.c:3866-3915
[Info] PR description lists pkcs7.c changes that are not present in the diff — wolfcrypt/src/pkcs7.c:14971-14975,15239-15243
[Info] SendTls13Certificate depth guard is now defense-in-depth only and its direct test path was removed — src/tls13.c:9523-9526

Review generated by Skoll

- ProcessUserChain: enforce MAX_CHAIN_DEPTH after a cert is parsed, so a full-depth chain followed by trailing data still loads instead of failing with MAX_CHAIN_ERROR. - SendCertificateStatus: error on an over-long OCSP chain instead of silently truncating the stapled response; keep the chainOcspRequest[] index bound. - wc_PKCS7_DecodeAuthEnvelopedData: bounds-check the authTag tag read under NO_PKCS7_STREAM. - Tests: chain-depth test now pins the boundary (exactly MAX_CHAIN_DEPTH loads, one more rejected).

…h-and-parser-bounds # Conflicts: # src/ssl.c

…ls.h

ColtonWilley marked this pull request as draft April 13, 2026 21:58

dgarske assigned ColtonWilley Apr 21, 2026

ColtonWilley force-pushed the harden-chain-depth-and-parser-bounds branch from 9a2f68d to 3304644 Compare May 5, 2026 19:00

ColtonWilley force-pushed the harden-chain-depth-and-parser-bounds branch 2 times, most recently from 089287c to d84c824 Compare May 27, 2026 21:13

ColtonWilley marked this pull request as ready for review May 27, 2026 21:22

ColtonWilley requested review from dgarske and julek-wolfssl May 27, 2026 21:22

ColtonWilley commented May 27, 2026

View reviewed changes

Comment thread tests/api/test_dtls.c Outdated

ColtonWilley added 3 commits May 27, 2026 17:16

Add test cases for max chain depth fixes

eb180db

ColtonWilley force-pushed the harden-chain-depth-and-parser-bounds branch from d84c824 to 359fb7e Compare May 28, 2026 00:24

julek-wolfssl requested a review from Copilot May 29, 2026 13:58

Copilot started reviewing on behalf of julek-wolfssl May 29, 2026 13:58 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

Comment thread wolfcrypt/src/pkcs7.c

Comment thread tests/api/test_pkcs7.c

Comment thread wolfcrypt/src/pkcs7.c

Comment thread tests/api/test_pkcs7.c

julek-wolfssl previously requested changes May 29, 2026

View reviewed changes

dgarske removed their request for review June 1, 2026 17:07

dgarske assigned ColtonWilley and unassigned ColtonWilley Jun 1, 2026

ColtonWilley requested a review from julek-wolfssl June 2, 2026 23:41

Fix maybe-uninitialized count in test_wolfSSL_get_chain_idx_bounds

ed11ac7

ColtonWilley requested a review from wolfSSL-Bot June 8, 2026 18:24

dgarske assigned wolfSSL-Bot Jun 8, 2026

dgarske unassigned ColtonWilley Jun 8, 2026

dgarske removed the request for review from wolfSSL-Bot June 8, 2026 19:23

dgarske reviewed Jun 8, 2026

View reviewed changes

Comment thread src/ssl_load.c Outdated

Comment thread tests/api.c

Comment thread wolfcrypt/src/pkcs7.c

Comment thread src/tls13.c

dgarske assigned ColtonWilley Jun 8, 2026

ColtonWilley added 4 commits June 8, 2026 17:27

Merge remote-tracking branch 'upstream/master' into harden-chain-dept…

d312aa0

…h-and-parser-bounds # Conflicts: # src/ssl.c

Remove leftover line re-wrap in SendCertificateStatus

b046014

Remove dangling test_dtls13_oversized_cert_chain reference in test_dt…

3e8a130

…ls.h

julek-wolfssl approved these changes Jun 12, 2026

View reviewed changes

Frauschi approved these changes Jul 2, 2026

View reviewed changes

dgarske unassigned ColtonWilley Jul 2, 2026

dgarske self-requested a review July 2, 2026 15:32

douzzer approved these changes Jul 3, 2026

View reviewed changes

douzzer merged commit d638d2a into wolfSSL:master Jul 3, 2026
481 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Harden chain depth bounds and parser input validation#10209

Harden chain depth bounds and parser input validation#10209
douzzer merged 10 commits into
wolfSSL:masterfrom
ColtonWilley:harden-chain-depth-and-parser-bounds

ColtonWilley commented Apr 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 27, 2026 •

edited by ColtonWilley

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

julek-wolfssl left a comment

Uh oh!

ColtonWilley commented Jun 4, 2026

Uh oh!

ColtonWilley commented Jun 5, 2026 •

edited

Loading

Uh oh!

dgarske left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Uh oh!

Conversation

ColtonWilley commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Tests

Uh oh!

github-actions Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

github-actions Bot commented May 27, 2026 • edited by ColtonWilley Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

julek-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

ColtonWilley commented Jun 4, 2026

Uh oh!

ColtonWilley commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

ColtonWilley commented Apr 13, 2026 •

edited

Loading

github-actions Bot commented May 6, 2026 •

edited

Loading

github-actions Bot commented May 27, 2026 •

edited by ColtonWilley

Loading

ColtonWilley commented Jun 5, 2026 •

edited

Loading