CborValidateTagUse rejects valid tag 1 (epoch) with a floating-point value, and restricts tags 21-23 too much
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 86/100
Research direction
Inspect src/cborvalidation.c and the knownTagData table, then trace how cbor_value_validate applies CborValidateTagUse. Exercise tag 1 with integer and floating-point values and tags 21–23 with different content types; done means these valid RFC 8949 cases return CborNoError while existing restrictions remain covered.
Written by the indexing model from the issue text.
Description
CborValidateTagUse refuses valid CBOR for two groups of tags, because of the knownTagData table in src/cborvalidation.c (checked at main, 213155c8, and in the v7.0 release).
Tag 1 (epoch-based date/time) with a float
{ 1, (uint32_t)(CborIntegerType+1) },
allows only an integer. RFC 8949 §3.4.2 says:
The tag content MUST be an unsigned or negative integer (major types 0 and 1) or a floating-point number (major type 7 with additional information 25, 26, or 27).
So RFC 8949's own Appendix A example 1(1363896240.5), c1fb41d452d9ec200000, fails validation with CborErrorInappropriateTagForType:
static const uint8_t item[] = {0xc1, 0xfb, 0x41, 0xd4, 0x52, 0xd9, 0xec, 0x20, 0x00, 0x00};
CborParser parser;
CborValue it;
cbor_parser_init(item, sizeof item, 0, &parser, &it);
CborError err = cbor_value_validate(&it, CborValidateTagUse);
/* err == CborErrorInappropriateTagForType; expected CborNoError */
The same happens for a half or single-precision float under tag 1.
Tags 21, 22 and 23
These entries allow only a byte string, array or map. RFC 8949 §3.4.5.2 says:
The data item tagged can be a byte string or any other data item.
So, for example, 21("text") (d5 64 74 65 78 74) or 23(1) (d7 01) is refused, although it is valid.
Suggested fix
- Tag 1: allow
CborHalfFloatType,CborFloatTypeandCborDoubleTypealongside the integer. - Tags 21–23: give them no type restriction, as tag 55799 has.
(Found while writing conformance tests for an R binding of TinyCBOR, zucbor, which now checks tag content itself as a workaround.)
- Dominant language
- C
- Stars
- 632
- Forks
- 222
- Avg merge
- 1d 25m
- Merged PRs (30d)
- 2
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from intel/tinycbor
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
-
Fixing CI/CDOpen
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
BasedHardware/omi#20401 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
php/frankenphp#2688 ·
Maintainers usually reply within 1 day
-
area/ysql kind/bug priority/medium
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
yugabyte/yugabyte-db#34584 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
bug priority-medium severity-medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 2 days