wbond/asn1crypto

Unexpected IndexError exception on malformed input

Open

#194 opened on Nov 9, 2020

View on GitHub
 (6 comments) (0 reactions) (0 assignees)Python (146 forks)github user discovery
enhancementhelp wanted

Repository metrics

Stars
 (359 stars)
PR merge metrics
 (PR metrics pending)

Description

When running the following code with the latest version of asn1crypto on the attached input in an unexpected IndexError exception:

import sys
from asn1crypto.core import Sequence

with open(sys.argv[1], 'rb') as f:
    data = f.read()
parsed = Sequence.load(data)
parsed.copy()  # force parsing
parsed.dump(force=True)

$ python3 asn2crypto_repro.py testcase.txt
Traceback (most recent call last):
  File "asn2crypto_repro.py", line 6, in <module>
    parsed = Sequence.load(data)
  File "/home/user/.local/lib/python3.8/site-packages/asn1crypto/core.py", line 230, in load
    value, _ = _parse_build(encoded_data, spec=spec, spec_params=kwargs, strict=strict)
  File "/home/user/.local/lib/python3.8/site-packages/asn1crypto/core.py", line 5668, in _parse_build
    info, new_pointer = _parse(encoded_data, encoded_len, pointer)
  File "/home/user/.local/lib/python3.8/site-packages/asn1crypto/parser.py", line 175, in _parse
    num = ord(encoded_data[pointer]) if _PY2 else encoded_data[pointer]
IndexError: index out of range

test.txt

Contributor guide

Research direction
Investigate the parsing logic in parser.py line 175 where IndexError occurs. The issue is triggered when encoded data is accessed with an out of bounds pointer. Add a check to ensure pointer < len(encoded data) before accessing, and handle malformed input gracefully.
Tech stack
python
Domain
securitybackend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Python
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70