Skip to content

Commit

Permalink
Add some tests for various PKCS12 files with NULL ContentInfo
Browse files Browse the repository at this point in the history
PKCS7 ContentInfo fields held within a PKCS12 file can be NULL, even if the
type has been set to a valid value. CVE-2024-0727 is a result of OpenSSL
attempting to dereference the NULL pointer as a result of this.

We add test for various instances of this problem.
  • Loading branch information
dongbeiouba committed Apr 15, 2024
1 parent fc6bbe4 commit 38bc04c
Show file tree
Hide file tree
Showing 4 changed files with 23 additions and 2 deletions.
25 changes: 23 additions & 2 deletions test/recipes/80-test_pkcs12.t
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
use strict;
use warnings;

use OpenSSL::Test qw/:DEFAULT srctop_file/;
use OpenSSL::Test qw/:DEFAULT srctop_file with/;
use OpenSSL::Test::Utils;

use Encode;
Expand Down Expand Up @@ -57,12 +57,33 @@ if (eval { require Win32::API; 1; }) {
}
$ENV{OPENSSL_WIN32_UTF8}=1;

plan tests => 1;
plan tests => 5;

# just see that we can read shibboleth.pfx protected with $pass
ok(run(app(["openssl", "pkcs12", "-noout",
"-password", "pass:$pass",
"-in", srctop_file("test", "shibboleth.pfx")])),
"test_pkcs12");

# Test some bad pkcs12 files
my $bad1 = srctop_file("test", "recipes", "80-test_pkcs12_data", "bad1.p12");
my $bad2 = srctop_file("test", "recipes", "80-test_pkcs12_data", "bad2.p12");
my $bad3 = srctop_file("test", "recipes", "80-test_pkcs12_data", "bad3.p12");

with({ exit_checker => sub { return shift == 1; } },
sub {
ok(run(app(["openssl", "pkcs12", "-in", $bad1, "-password", "pass:"])),
"test bad pkcs12 file 1");

ok(run(app(["openssl", "pkcs12", "-in", $bad1, "-password", "pass:",
"-nomacver"])),
"test bad pkcs12 file 1 (nomacver)");

ok(run(app(["openssl", "pkcs12", "-in", $bad2, "-password", "pass:"])),
"test bad pkcs12 file 2");

ok(run(app(["openssl", "pkcs12", "-in", $bad3, "-password", "pass:"])),
"test bad pkcs12 file 3");
});

SetConsoleOutputCP($savedcp) if (defined($savedcp));
Binary file added test/recipes/80-test_pkcs12_data/bad1.p12
Binary file not shown.
Binary file added test/recipes/80-test_pkcs12_data/bad2.p12
Binary file not shown.
Binary file added test/recipes/80-test_pkcs12_data/bad3.p12
Binary file not shown.

0 comments on commit 38bc04c

Please sign in to comment.