| commit | 8ebfea76db79bc5b1646fbe76e681f58b3363e9d | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Thu Mar 16 01:45:35 2023 -0400 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Tue Mar 21 22:35:09 2023 +0000 |
| tree | 2b51e9ecc2f8f04726e722af3359b8a3e567f760 | |
| parent | 2a52444f9d9e66b0dc317b8b25bdb4a3e4c7518c [diff] |
Reject non-minimal lengths in ASN1_get_object Now that the preceding CL has isolated the X.509 signature hack, we can apply the strictness across the legacy parser. This is particularly important for the TBSCertificate parser, where it is ambiguous which value one checks the signature over. (Officially, you're supposed to re-encode as DER. In practice, people don't do this.) This change means many of our primitive types are actually parsed as DER. I've removed the bug references in the comment in the documentation where I believe they're finally correct. Update-Note: Non-minimal lengths in certificates are no longer accepted, as required for standards compliance. The one exception is the signature field, where we still carry an exception. Some of this was already enforced by libssl's parser. Bug: 354 Change-Id: I57cfa7df9e1ec5707390e9b32fe1ec6b5d8172f9 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/58186 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: