Skip to content

surface malformed TSTInfo as TSPException in TimeStampToken - #2415

Open
rootvector2 wants to merge 1 commit into
bcgit:mainfrom
rootvector2:tsp-tstinfo-parse-exception
Open

surface malformed TSTInfo as TSPException in TimeStampToken#2415
rootvector2 wants to merge 1 commit into
bcgit:mainfrom
rootvector2:tsp-tstinfo-parse-exception

Conversation

@rootvector2

Copy link
Copy Markdown
Contributor

TimeStampToken parses the attacker-controlled TSTInfo eContent inside a try that catches only CMSException, so a well-formed TimeStampResp carrying a malformed TSTInfo (empty/short SEQUENCE, a non-SEQUENCE, or truncated DER) lets an unchecked IllegalArgumentException/ClassCastException/NoSuchElementException escape the TimeStampResponse(byte[]) / (InputStream) path's declared throws TSPException, IOException — the sibling TimeStampResponse(DLSequence) ctor already wraps new TimeStampToken(...), so this rethrows the parse failure as TSPException to match it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant