diff options
author | Andrew Scull <ascull@google.com> | 2021-03-30 12:48:04 +0000 |
---|---|---|
committer | Andrew Scull <ascull@google.com> | 2021-03-30 16:44:10 +0000 |
commit | 42a7aa8fbfe401dcb06cd07f7f9242a1ef3b9627 (patch) | |
tree | 18ff671c96f5878fc77ac63d4c15a53909e41071 | |
parent | 4d171a791a4e44ae1b061f122282d0448dc612b3 (diff) | |
download | libcppbor-42a7aa8fbfe401dcb06cd07f7f9242a1ef3b9627.tar.gz |
Reject reserved values and indefinite lengths
RFC 8949 defines additional information values 28, 29, 30 and 31 as
either reserved or indicating indefinite length values. Reject all of
these.
Test: cppbor_host_test_external
Change-Id: Ic9ae7630c8f75d060e4199d375c1f696699a4f66
-rw-r--r-- | src/cppbor_parse.cpp | 7 | ||||
-rw-r--r-- | tests/cppbor_test.cpp | 20 |
2 files changed, 26 insertions, 1 deletions
diff --git a/src/cppbor_parse.cpp b/src/cppbor_parse.cpp index 5cf76b2..fcf0dac 100644 --- a/src/cppbor_parse.cpp +++ b/src/cppbor_parse.cpp @@ -202,8 +202,13 @@ std::tuple<const uint8_t*, ParseClient*> parseRecursively(const uint8_t* begin, bool success = true; uint64_t addlData; - if (tagInt < ONE_BYTE_LENGTH || tagInt > EIGHT_BYTE_LENGTH) { + if (tagInt < ONE_BYTE_LENGTH) { addlData = tagInt; + } else if (tagInt > EIGHT_BYTE_LENGTH) { + parseClient->error( + begin, + "Reserved additional information value or unsupported indefinite length item."); + return {begin, nullptr}; } else { switch (tagInt) { case ONE_BYTE_LENGTH: diff --git a/tests/cppbor_test.cpp b/tests/cppbor_test.cpp index 8a81e4e..ef98519 100644 --- a/tests/cppbor_test.cpp +++ b/tests/cppbor_test.cpp @@ -1714,6 +1714,26 @@ TEST(FullParserTest, ViewBstr) { EXPECT_THAT(item, MatchesItem(val)); } +TEST(FullParserTest, ReservedAdditionalInformation) { + vector<uint8_t> reservedVal = {0x1D}; + + auto [item, pos, message] = parse(reservedVal); + EXPECT_THAT(item, IsNull()); + EXPECT_EQ(pos, reservedVal.data()); + EXPECT_EQ("Reserved additional information value or unsupported indefinite length item.", + message); +} + +TEST(FullParserTest, IndefiniteArray) { + vector<uint8_t> indefiniteArray = {0x7F}; + + auto [item, pos, message] = parse(indefiniteArray); + EXPECT_THAT(item, IsNull()); + EXPECT_EQ(pos, indefiniteArray.data()); + EXPECT_EQ("Reserved additional information value or unsupported indefinite length item.", + message); +} + TEST(MapGetValueByKeyTest, Map) { Array compoundItem(1, 2, 3, 4, 5, Map(4, 5, "a", "b")); auto clone = compoundItem.clone(); |