Skip to content

Fix i2d_ASN1_TYPE() error check#1012

Open
ndossche wants to merge 1 commit intoruby:masterfrom
ndossche:clesss-3
Open

Fix i2d_ASN1_TYPE() error check#1012
ndossche wants to merge 1 commit intoruby:masterfrom
ndossche:clesss-3

Conversation

@ndossche
Copy link
Contributor

The OpenSSL docs / LibreSSL docs are slightly misleading wrt the error return values. 0 is also an error value.
This can be proven by looking at the call chain:
i2d_ASN1_TYPE -> ASN1_item_i2d -> asn1_item_flags_i2d -> ASN1_item_ex_i2d and noticing that ASN1_item_ex_i2d can return 0 on error.

This was found by a hybrid static-dynamic analyser that looks for inconsistent handling of error checks in bindings.

The OpenSSL docs / LibreSSL docs are slightly misleading wrt the error
return values. 0 is also an error value.
This can be proven by looking at the call chain:
`i2d_ASN1_TYPE -> ASN1_item_i2d -> asn1_item_flags_i2d -> ASN1_item_ex_i2d`
and noticing that ASN1_item_ex_i2d can return 0 on error.
@rhenium
Copy link
Member

rhenium commented Feb 26, 2026

The inconsistent return values look like more of a bug in OpenSSL which should be fixed there: https://github.com/openssl/openssl/blob/5971d32cfbf6ee34b0b4681ed693baddfe3573b4/crypto/asn1/tasn_enc.c

If this isn't causing an actual issue in ruby/openssl, I prefer not to introduce a workaround.

@ndossche
Copy link
Contributor Author

That's fair, although the extension already works around it in the OCSP code:

if((len = i2d_OCSP_REQUEST(req, NULL)) <= 0)
ossl_raise(eOCSPError, NULL);

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants