Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unexpected IndexError exception on malformed input #194

Open
Google-Autofuzz opened this issue Nov 9, 2020 · 6 comments
Open

Unexpected IndexError exception on malformed input #194

Google-Autofuzz opened this issue Nov 9, 2020 · 6 comments

Comments

@Google-Autofuzz
Copy link

When running the following code with the latest version of asn1crypto on the attached input in an unexpected IndexError exception:

import sys
from asn1crypto.core import Sequence

with open(sys.argv[1], 'rb') as f:
    data = f.read()
parsed = Sequence.load(data)
parsed.copy()  # force parsing
parsed.dump(force=True)
$ python3 asn2crypto_repro.py testcase.txt
Traceback (most recent call last):
  File "asn2crypto_repro.py", line 6, in <module>
    parsed = Sequence.load(data)
  File "/home/user/.local/lib/python3.8/site-packages/asn1crypto/core.py", line 230, in load
    value, _ = _parse_build(encoded_data, spec=spec, spec_params=kwargs, strict=strict)
  File "/home/user/.local/lib/python3.8/site-packages/asn1crypto/core.py", line 5668, in _parse_build
    info, new_pointer = _parse(encoded_data, encoded_len, pointer)
  File "/home/user/.local/lib/python3.8/site-packages/asn1crypto/parser.py", line 175, in _parse
    num = ord(encoded_data[pointer]) if _PY2 else encoded_data[pointer]
IndexError: index out of range

test.txt

@joernheissler
Copy link
Collaborator

Hi,
the error message could be clearer, but is there any real problem?
You're getting an exception for malformed input. Sounds fine to me.

@Google-Autofuzz
Copy link
Author

I would expect an exception provided by asn1crypto.
I didn't manage to find the right™ way to handle exceptions that could be raised by asn1crypto in its documentation. Is except Exception the way to go?

@joernheissler
Copy link
Collaborator

https://github.com/wbond/asn1crypto/blob/master/asn1crypto/core.py#L159
raises ValueError - when the ASN.1 header length is longer than the data.

I expect (really not sure) that all parser errors will be some ValueError.

@Google-Autofuzz
Copy link
Author

IndexError isn't a ValueError.

@joernheissler
Copy link
Collaborator

IndexError isn't a ValueError.

whoops :-)

@wbond
Copy link
Owner

wbond commented Nov 9, 2020

I think we can improve the parse functions to be sure to raise a ValueError

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants