Skip to content

MONGOCRYPT-891 fix check in KMIP parser #1142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kevinAlbs merged 3 commits into from
Apr 1, 2026
Merged

MONGOCRYPT-891 fix check in KMIP parser #1142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
60d2d18
add regression test
kevinAlbs Mar 30, 2026
4e4d144
MONGOCRYPT-891 check length before recursing
kevinAlbs Mar 30, 2026
a4fc51d
add check in kmip_reader_find_and_recurse as safety check
kevinAlbs Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions kms-message/src/kms_kmip_reader_writer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -451,6 +451,7 @@ kmip_reader_find (kmip_reader_t *reader,
if (read_tag == search_tag && read_type == type) {
*pos = reader->pos;
*length = read_length;
CHECK_REMAINING_BUFFER_AND_RET (compute_padded_length(read_length));
return true;
}

Expand All @@ -477,6 +478,10 @@ kmip_reader_find_and_recurse (kmip_reader_t *reader, kmip_tag_type_t tag)
}

reader->pos = 0;

if (pos + compute_padded_length (length) > reader->len) {
return false;
}
reader->ptr = reader->ptr + pos;
reader->len = length;
return true;
Expand Down
20 changes: 20 additions & 0 deletions kms-message/test/test_kmip_reader_writer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,26 @@ kms_kmip_reader_find_and_recurse_test (void)
free (data);
}

void kms_kmip_reader_find_and_recurse_invalid_test (void); // -Wmissing-prototypes: for testing only.
void
kms_kmip_reader_find_and_recurse_invalid_test (void)
{
uint8_t *data;
size_t datalen;
kmip_reader_t *reader;

// Structure with overly large length:
data = hex_to_data (
"42 00 20 | 01 | 00 00 00 FF", // Struct with bad length
&datalen);

reader = kmip_reader_new (data, datalen);
// Expect error:
ASSERT (!kmip_reader_find_and_recurse (reader, KMIP_TAG_CompromiseDate));
kmip_reader_destroy (reader);
free (data);
}

void kms_kmip_reader_find_and_read_enum_test (void); // -Wmissing-prototypes: for testing only.
void
kms_kmip_reader_find_and_read_enum_test (void)
Expand Down
2 changes: 2 additions & 0 deletions kms-message/test/test_kms_request.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1216,6 +1216,7 @@ extern void kms_kmip_reader_test (void);
extern void kms_kmip_reader_negative_int_test (void);
extern void kms_kmip_reader_find_test (void);
extern void kms_kmip_reader_find_and_recurse_test (void);
extern void kms_kmip_reader_find_and_recurse_invalid_test (void);
extern void kms_kmip_reader_find_and_read_enum_test (void);
extern void kms_kmip_reader_find_and_read_bytes_test (void);
extern void kms_kmip_request_register_secretdata_test (void);
Expand Down Expand Up @@ -1280,6 +1281,7 @@ main (int argc, char *argv[])
RUN_TEST (kms_kmip_reader_negative_int_test);
RUN_TEST (kms_kmip_reader_test);
RUN_TEST (kms_kmip_reader_find_and_recurse_test);
RUN_TEST (kms_kmip_reader_find_and_recurse_invalid_test);
RUN_TEST (kms_kmip_reader_find_and_read_enum_test);
RUN_TEST (kms_kmip_reader_find_and_read_bytes_test);
RUN_TEST (kms_kmip_request_register_secretdata_test);
Expand Down