Skip to content

Simplify d2i_PKCS7 by removing redundant BER-to-DER conversion#3037

Merged
WillChilds-Klein merged 3 commits intoaws:mainfrom
justsmth:fix-pkcs7-ber
Feb 27, 2026
Merged

Simplify d2i_PKCS7 by removing redundant BER-to-DER conversion#3037
WillChilds-Klein merged 3 commits intoaws:mainfrom
justsmth:fix-pkcs7-ber

Conversation

@justsmth
Copy link
Copy Markdown
Contributor

@justsmth justsmth commented Feb 24, 2026

Description of changes:

d2i_PKCS7 previously performed a manual BER-to-DER conversion using
CBS_asn1_ber_to_der before passing the result to ASN1_item_d2i. This
manual conversion had a bug: when BER input contained indefinite-length
elements, the converted DER encoding was shorter than the original BER, but
*in was advanced by the DER byte count rather than the original BER byte
count. This caused *in to be under-advanced, violating the d2i API contract.

Since ASN1_item_d2i already handles BER encoding natively (including
indefinite-length elements and constructed strings), the manual conversion
was redundant. This change removes it entirely and replaces
IMPLEMENT_ASN1_ALLOC_FUNCTIONS(PKCS7) plus the hand-written d2i_PKCS7
and i2d_PKCS7 with a single IMPLEMENT_ASN1_FUNCTIONS(PKCS7) macro call,
consistent with every other type defined in this file.

The now-unused #include "../bytestring/internal.h" has also been removed.

Call-outs:

The existing BER test in TestCertReparse was asserting the old (incorrect)
pointer-advancement behavior for BER input, expecting *in to advance by
only the DER-converted length. This has been updated to expect full
advancement past the original input, consistent with the non-BER path.

Testing:

All 60 existing PKCS7 tests pass (crypto_test --gtest_filter='*PKCS7*').

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

samuel40791765
samuel40791765 previously approved these changes Feb 24, 2026
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Feb 24, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.35%. Comparing base (40ec390) to head (15cae8f).
⚠️ Report is 58 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3037      +/-   ##
==========================================
- Coverage   78.36%   78.35%   -0.01%     
==========================================
  Files         689      689              
  Lines      121042   121022      -20     
  Branches    16967    16965       -2     
==========================================
- Hits        94851    94830      -21     
- Misses      25295    25296       +1     
  Partials      896      896              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@justsmth justsmth changed the title Update PKCS7 BER parsing Simplify d2i_PKCS7 by removing redundant BER-to-DER conversion Feb 25, 2026
@WillChilds-Klein WillChilds-Klein enabled auto-merge (squash) February 26, 2026 19:06
samuel40791765
samuel40791765 previously approved these changes Feb 26, 2026
@WillChilds-Klein WillChilds-Klein merged commit c2548e4 into aws:main Feb 27, 2026
673 of 694 checks passed
@justsmth justsmth deleted the fix-pkcs7-ber branch February 27, 2026 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants